No enterprise tax. Just bulletproof quantum security for fast-moving teams. See Plans →
QuantCert replaces passwords with Dilithium2 digital signatures and encrypts every credential with ML-KEM-1024. There is no password to steal. There is no plaintext to expose. There is no migration to plan.
Three cryptographic facts that separate QuantCert from every other credential manager.
Passwords transmitted during authentication
ML-DSA-44 — NIST FIPS 204 signature algorithm powering every login
Milliseconds or less for a full post-quantum authentication round trip
Most password managers say they can't read your data. QuantCert is engineered so that even we cannot — regardless of what we claim.
Here is what happens when you authenticate:
Your device generates a Dilithium2 keypair locally. The private key is stored in chrome.storage.local and never transmitted. When you log in, our server sends a random nonce. Your device signs it with your private key. We verify the signature against your stored public key. No password is involved at any point.
Your vault credentials are encrypted with AES-256-GCM using keys derived from your public key fingerprint via HKDF-SHA256. We store ciphertext. We cannot reverse it. This is not a policy — it is mathematics.
Zero-knowledge architecture isn't a feature. It is the constraint that every other feature is built within.
Every login is a Dilithium2 zero-knowledge challenge-response. No password is typed, transmitted, or stored. The private key never leaves your device. Resistant to phishing, credential stuffing, brute force, and future quantum attacks simultaneously.
Credentials are encrypted with AES-256-GCM using keys encapsulated with ML-KEM-1024 (NIST FIPS 203). Even if an adversary intercepts your encrypted vault data today, they cannot decrypt it when quantum computers arrive. This is Harvest Now, Decrypt Later protection by default.
Every authentication event is evaluated by an AI risk model using IP address, user agent, time of day, and historical patterns. Risk scores are assigned in real time. High-risk events are queued for admin approval before access is granted — not after a breach is detected.
The QuantCert Chrome extension detects login forms, retrieves encrypted credentials, and fills them without exposing plaintext to the browser. Credentials are autofilled directly into form fields and discarded from memory immediately after. No clipboard. No visible values.
Service accounts, CI/CD pipelines, IoT devices, and AI agents get the same cryptographic protection as human users. Store API keys, SSH keys, TLS certificates, and tokens in the same zero-knowledge vault. Rotate on schedule. Every access is logged.
Every authentication event is forwarded to Splunk HEC, Microsoft Sentinel, or any HTTPS webhook in real time. Compliance reports for SOC 2, ISO 27001, and HIPAA export in one click from the audit log. Every event is Dilithium-signed and tamper-evident.
Authentication without a password.
Step 1 — Keypair generation. On first use, the QuantCert browser extension generates a Dilithium2 (ML-DSA-44) keypair locally. Your private key is stored in chrome.storage.local and never transmitted to our servers.
Step 2 — Challenge request. When you need to authenticate, the extension requests a cryptographically random nonce from our server. The nonce has a 5-minute TTL and is single-use.
Step 3 — Dilithium2 signing. Your extension signs the nonce with your private key using ML-DSA-44 via liboqs WASM running locally. The signature is approximately 2,420 bytes. Your private key is used in memory only — it is not persisted beyond the signing operation.
Step 4 — Server verification. Our Lambda verifies the Dilithium2 signature against your stored public key, burns the challenge, and issues a short-lived verified token. The AI Trust Engine evaluates the event asynchronously.
Step 5 — Vault unlock. With a valid verified token, your encrypted credentials are returned as ciphertext. The extension decrypts them locally, fills the form, and discards the plaintext from memory.
Step 6 — Audit. Every step is written to a tamper-evident, Dilithium-signed audit log with 90-day retention.
Most credential managers are built for humans. QuantCert is built for the full identity surface of a modern organization.
Employees authenticate with Dilithium2 signatures via the browser extension. No master password. No TOTP codes. No friction. Session timeout, idle lock, and MFA enforcement are configurable per policy.
Service accounts and API keys stored in the zero-knowledge vault with automated rotation schedules. Every machine authentication is logged with the same trust engine risk scoring as human logins.
AI agents and LLM-powered workflows authenticate via headless vault API using M2M client credentials. Ephemeral credentials auto-expire after the session. Every access is audit-logged with the agent identifier and purpose.
Pull secrets into GitHub Actions, GitLab CI, or any pipeline via the QuantCert SDK or CLI. No secrets in environment variables. No secrets in repository configuration. Every pipeline run logged as a machine authentication event.
