Ciphera ID
The sign-in layer behind every Ciphera product — what it does, what it never sees, and where your account controls actually live.
Ciphera ID is the account you sign in with. It is not a product you configure
on its own: you meet it when a Ciphera application sends you to
id.ciphera.net to prove who you are, and it sends you straight back over
OAuth 2.0 with mandatory PKCE. Today the application that does that is
Pulse, with more of our own services to follow.
It handles the ceremonies — signing up, signing in, and recovering an account — and nothing else. Everything you would think of as a setting lives in the application you are using, not here. If you are looking for two-factor authentication, passkeys, devices or your sign-in email, those are on Account Settings.
What the server never learns
Sign-in uses OPAQUE (RFC 9807), an asymmetric password-authenticated key exchange. Your password is never sent, not even hashed: the browser and the server run a ceremony that ends with both sides agreeing you knew the password, while the server holds only a record it cannot work backwards from. There is no password hash to steal, because there is no password hash.
Your email address is stored encrypted. Looking an account up uses a blind index instead — a key derived in your browser from the address itself (PBKDF2, one million iterations), which the server can match without being able to reverse. That is why signing in feels slower on a cheap phone than a login form usually does: the work is real, and it happens on your device.
The vault key that decrypts your own data is unwrapped from the OPAQUE exchange, in the browser, as a non-extractable key. No copy of it reaches us in any form.
Recovering an account
Recovery is available. It works from the 24-word phrase shown once at signup, and it is a real cryptographic ceremony rather than an email link: the phrase drives a second OPAQUE identity, which is what lets you set a new password without anyone at Ciphera ever being able to do it for you.
Warning
An account can only be recovered if it enrolled a recovery identity, and enrolment needs the account's own password. That means there is no backfill — an account that has never enrolled cannot be given recovery retroactively by us, because the key material required simply is not ours to hold. If you still have access, enrol now rather than later.
The /recover page deliberately gives the same answer to an address it has
never seen and to an account that has not enrolled. Telling those apart would
turn the page into a way of testing whether somebody has a Ciphera account, so
it declines to resolve the ambiguity and says so instead.
What it is not
Ciphera ID is not a general-purpose identity platform. It is not something you can point your own application at, there is no tenant model, and there is no admin console for managing other people's accounts. We would rather say that here than have you discover it after a procurement call.
The part of this that you can build on is open source: Tessera, the OPAQUE implementation underneath, published under Apache-2.0 with a Rust core, a Go server SDK and a browser SDK.
Elsewhere
- Account Settings — password, two-factor, passkeys, devices and sessions.
- Ciphera ID on ciphera.net — the product overview.
- Service status — live operational state.
- Changelog — release notes as features ship.