Skip to content
Anon Wallet

Authentication

Anon supports two authentication methods: passkeys (recommended) and passwords. Both support the wallet key hierarchy, using different methods to derive and protect the root secret.

Passkeys (WebAuthn PRF)

Passkeys use the WebAuthn standard with the PRF extension (Pseudo-Random Function). When you authenticate with a passkey:

  1. Your browser prompts your device authenticator (Touch ID, Face ID, Windows Hello, or a FIDO2 hardware key)
  2. The authenticator runs a HMAC-PRF keyed to your Anon credential
  3. The PRF output — a 32-byte deterministic secret — is used to derive your wallet keys

Why Passkeys Are Better

  • Authenticator-protected: storage, device binding, and synchronization depend on the authenticator. PRF support is required; a passkey is not a guarantee against a compromised device.
  • Phishing-resistant: WebAuthn credentials are bound to the origin (chrome-extension://...). A phishing site cannot request your passkey.
  • No typed password: this avoids exposing a wallet password to a keylogger, while session secrets still need protection.
  • Biometric convenience: authentication is a single touch or glance.

Supported Authenticators

Availability depends on the browser, OS, authenticator, and PRF support. Check compatibility during setup; the examples below are not a guarantee that every version works.

  • Touch ID (Mac)
  • Face ID (iPhone/iPad as a roaming authenticator via Bluetooth)
  • Windows Hello
  • YubiKey and other FIDO2 hardware security keys

Password Authentication

If you choose to authenticate with a password, Anon uses Argon2id to derive your root key:

  • Argon2id is a memory-hard password hashing algorithm designed to make offline guessing more expensive
  • Anon uses a high memory cost parameter (64 MB) to make offline brute-force attacks expensive
  • A random salt is stored in chrome.storage.local; the derived key never touches the server

Password authentication is convenient but slightly less secure than passkeys because:

  • The password exists in memory during derivation (short window of exposure)
  • A weak password is still vulnerable to offline attack if storage is stolen

Use a long, unique passphrase.

Session Management

After authentication, Anon creates a session:

  • The view-only key is loaded into memory for background sync
  • The spending key is loaded on demand when you initiate a transaction
  • The session expires after the configured timeout

When the session expires, Anon locks and all session keys are cleared from memory.

Auto-Lock

Anon can lock automatically in response to system events:

  • Idle timeout: after N minutes of inactivity
  • OS lock: when the device screen locks or goes to sleep (requires the appropriate browser extension API, enabled by default)
  • Browser close: always triggers a lock

You can configure these behaviors in Settings → Security.