How it works

The premise

Say two people both end up with hello in a password field. One typed it straight through. The other typed hellp, hit backspace and typed o. With Palimpsest, those are different passwords. It records every edit in order, turns that into a standard transcript, and uses the transcript as the credential.

It’s built as a set of TypeScript packages: the core that turns edits into a transcript, a browser capture SDK, server-side verification, React, Vue and Svelte adapters, and an Auth0 integration. It isn’t published to npm yet. The threat model comes first in the docs: it protects against attacks that can see what ends up in the field, but not against someone who controls the keyboard input itself.

What’s included

Every keystroke and edit, in order, turned into a consistent transcript

Characters you typed and then deleted never show up in the field, but still count toward the password

Argon2id key derivation, replay protection and rate limiting, with an optional OPAQUE mode

A clear threat model, including what the scheme doesn’t protect against

How it’s built

Palimpsest is built on TypeScript, Argon2id, OPAQUE and Auth0.

It lives in a private repository, and its history isn’t published.

How the work is done

Every project here starts as a written spec, and the spec stays the source of truth once there’s code. The repository keeps a build plan with current status, an append-only decision log of where the code departed from the plan, and a handoff document that describes where things stand, including the unfinished parts.

That’s how one person keeps this many projects moving, and it’s what this page is written from.

Current state

In development. Being worked on now.

The source is private, so the way to check what this page says is to use the product.