Palimpsest / Documentation
Palimpsest, in detail
A password scheme where how you type it matters, not just what you type
Project brief
Say two people both end up with hello in a password field. One typed it straight through. The other typed hellp, hit backspace and typed o. With Palimpsest, those are different passwords. It records every edit in order, turns that into a standard transcript, and uses the transcript as the credential.
It’s built as a set of TypeScript packages: the core that turns edits into a transcript, a browser capture SDK, server-side verification, React, Vue and Svelte adapters, and an Auth0 integration. It isn’t published to npm yet. The threat model comes first in the docs: it protects against attacks that can see what ends up in the field, but not against someone who controls the keyboard input itself.
What’s included
• Every keystroke and edit, in order, turned into a consistent transcript
• Characters you typed and then deleted never show up in the field, but still count toward the password
• Argon2id key derivation, replay protection and rate limiting, with an optional OPAQUE mode
• A clear threat model, including what the scheme doesn’t protect against
Current status
This project is in active development, so details may change.
Questions and support
For questions about Palimpsest, contact DWMM Holdings with the project name and a short description of what you need. Please don’t send credentials or other sensitive information by email.