Packages

@paramira/webauthn-lock

Keeps a secret on the device locked behind a platform authenticator (Touch ID, Windows Hello, a hardware key) with WebAuthn's PRF extension; the authenticator never sees the secret.

License: AGPL-3.0-or-later

Source: packages/webauthn-lock

What it does

Gates a locally-stored secret behind a platform authenticator — Touch ID, Windows Hello, a hardware key — using WebAuthn's PRF extension. The authenticator never sees the secret; PRF gives a deterministic, credential-bound value only obtainable after a real user-verification ceremony, used as an AES-256-GCM key via @paramira/aes-gcm.

Progressive enhancement by design. createLock/unlock return null — never throw — when the browser lacks the API, the user cancels, or the authenticator doesn't support PRF. Treat "no lock" as a normal outcome (fall back to unprotected storage), not a hard requirement — a device that can't do this shouldn't be locked out of its own data.

Used by

Apps: abantu, isoko-web, iwacu-nuxt

In tests or development only: paramira-suite.

Uses

aes-gcm

web-session

Browser sessions signed in with the Paramira phone app: a session key and the phone's delegation, never the identity key; ends on sign-out, expiry or revocation.

Apps

The apps people use: on the phone, the desktop and the web.