identity / open source

DarkAuth

Zero-knowledge authentication. Your server never sees a password.

DarkAuth is a zero-knowledge authentication server with OpenID Connect compatibility. Passwords are handled with OPAQUE, so the server never learns them, and trusted clients can receive their data keys without the server ever seeing them in the clear. It is open source and self-hosted, with no paid plan or cloud service.

WHAT IT DOES

  • Passwords that never arrive

    The OPAQUE protocol means users prove they know their password without it ever reaching the server.

  • Speaks OIDC

    Standard OAuth 2.0 and OpenID Connect, so it drops in wherever you need sign-in.

  • Zero-knowledge key delivery

    Optionally hand encryption keys to trusted apps without the server being able to read them.

  • MFA and recovery

    TOTP for users and admins with backup codes, rate limits and self-service email password resets.

  • Roles and organisations

    Fine-grained permissions and organisation-scoped roles for everyone who signs in.

  • One container

    Ships as a Docker image. Point it at PostgreSQL or use the embedded database and you're up.

WHERE IT FITS

DarkAuth runs on Puzed Platform, so it sits on hardware you own alongside the rest of the Puzed stack.

Works with

← all products