In development · Developer tooling
Palimpsest
A password scheme where how you type it matters, not just what you type.
DWMM Holdings · In development · TypeScript, Argon2id, OPAQUE
Abstract
A password is usually just the text that ends up in the field. Palimpsest also counts how it got there: every character typed and deleted, in order. It turns that edit stream into a standard transcript and uses the transcript as the credential, so someone who learns the finished text still can’t sign in. This page covers the idea, what it does and doesn’t protect against, how it’s built, and where it stands.
1The idea
Say two people both end up with hello in a password field. One typed it straight through. The other typed hellp, hit backspace and typed o. With Palimpsest, those are different passwords. It records every edit in order, turns that into a standard transcript, and uses the transcript as the credential.
| Typed as | Field shows | Edit transcript | Credential |
|---|---|---|---|
| Straight through | hello | +h+e+l+l+o | 49a0 604d 1147 4e10 |
| With a correction | hello | +h+e+l+l+p⌫+o | 6937 82f2 c00e c7f1 |
Your edits appear here as you make them.
Field shows — · credential —
2Threat model
The threat model comes first in the specification, because it decides where the scheme is worth using.
Defends against
Anyone who only has the finished value: a leaked or reused password, or a copy of what ended up in the field.
Does not defend against
An attacker who controls the input path itself, like a keylogger, sees the edits as they happen. Palimpsest doesn’t try to stop that.
3Construction
The specification is implemented as a set of TypeScript packages, each with one job. The core is the trust root: everything else depends on it producing the same transcript from the same edits.
| Part | What it does |
|---|---|
| Core | Turns the stream of edits into a standard transcript. Everything else trusts it, so it’s covered by property and fuzz tests. |
| Client | Captures edits in the browser as they happen. |
| Server | Verifies a transcript against the stored credential, with Argon2id, replay protection and rate limiting. |
| Adapters | React, Vue and Svelte components. |
| Auth0 | An integration that adds Palimpsest to an existing Auth0 login. |
4Status
In development. The specification is implemented as a set of TypeScript packages. They aren’t published to npm yet, so there’s nothing to install today.
If this is useful to you, or you’d like to see it built, get in touch