Learning Center
Offline authentication
Offline authentication verifies a person or device without contacting a server, using signatures and credentials issued in advance. Learn how verifiable credentials, challenge-response and trust on first use work, and how revocation reaches devices that are offline.
Basics
What is offline authentication?Verifying people and devices with no server, and what that can and cannot prove.→How can you verify someone with no internet?Keys and signed credentials set up in advance, a fresh challenge, and what stays unknown.→When is trust on first use (TOFU) safe?The one window TOFU leaves open, when that risk is acceptable, and how to close it.→Offline authentication vs offline authorizationWho someone is versus what they may do, and how each holds up with no server.→Does self-sovereign identity work offline?Which parts of a self-sovereign identity check work offline, and which do not.→
Credentials
What is a verifiable credential?Signed claims a holder carries and a verifier checks, in the W3C model.→What is an issuer-signed credential?A signed statement checked with the issuer's public key, and the limits of that check.→What is challenge-response authentication?Proving you hold a key by answering a fresh challenge, so old answers cannot be replayed.→What is account binding?Linking a device key to an account with a signed nonce, and what that proves.→Do passkeys work offline?Which parts of passkey sign-in happen on the device, and which need the server.→Do you need a certificate authority offline?Checking certificate chains offline, and pinning, self-certifying keys and TOFU instead.→How do you revoke access when devices are offline?Short expiry, carried revocation lists, and deciding how stale is too stale.→