Only administrators can create invitations. Passwords must be strong (16+ chars). TOTP is mandatory. You generate ML-DSA-87 + ML-KEM-1024+X448 keypairs locally; private keys stay in your browser (encrypted in IndexedDB). Only PUBLIC keys are uploaded during registration.

Account pending. Enroll TOTP, generate local keys, sign setup, upload PUBLIC keys, then activate.

totp enrollment

bring your own keypair (BYOK)

local key passphrase (encrypts private keys in IndexedDB)

generate local keypairs (WASM)sign setup & upload PUBLIC keys

setup signing input auth public key (base64, ML-DSA-87) mailbox public key (base64, ML-KEM-1024+X448) ML-DSA-87 signature (base64)

activate

current TOTP code

verify TOTP & activate

recovery codes

Save these now. They are shown once.

go to login

download sensitive local key bundle (JSON)