NullLink Identity Vault

What is NullLink Identity?

NullLink Identity is a personal digital vault that lets you prove who you are online without giving away your personal information.

Think of it like a safe-deposit box:

You put your personal details (email, phone, address, etc.) into the box.
You lock it with a passphrase that only you know.
The vault (this service) holds the locked box but cannot open it — it has no key.
When a service needs your email, you open the box, take out just that one thing, seal it in an envelope addressed only to that service, and hand it over. Nobody else can read it.

You receive a NullLink ID (NL-ID) — a string like nl_VMfJcR7k... that works as your username everywhere. No email address needed to log in.

How do I create my NullLink ID?

1On the home screen, enter your invitation code (format: NLI-XXXXXXXXXXXX). You get this from the NullLink administrator. Once accepted, the vault opens.

2Choose a passphrase — at least 12 characters. This is the master key that encrypts everything in your vault. Use something long and memorable, like a sentence: my dog loves swimming in lake zurich!

3Confirm the passphrase by typing it again.

4Click "Generate My NullLink ID". Your browser generates two cryptographic key pairs (one for signing, one for encryption) and encrypts them with your passphrase. Only the encrypted version is sent to the server.

5Your NL-ID appears (e.g. nl_VMfJcR7kw7x8...). Copy it and save it — you'll use it to log in. Also click "Export Backup" immediately (see the Backup section below).

Critical: There is no "forgot password" feature. If you lose your passphrase AND your backup file, your identity is gone forever. This is by design — it means nobody else can ever access your vault either.

How do I log in to NullLink with my NL-ID?

1Go to nulllink.ch/login.

2Click the teal "Sign in with NullLink ID" button.

3Enter your NL-ID (starts with nl_).

4Enter your vault passphrase.

5Click "Sign In with NL-ID". Behind the scenes, your browser decrypts your private key, signs a challenge from the server, and sends only the signature. Your passphrase never leaves your device.

That's it — you're logged in without ever typing an email address or password that a server can see.

How do I store credentials (email, phone, address)?

1Open your vault (enter NL-ID + passphrase on the home screen, or go to ids.nulllink.ch).

2In the Credentials tab, select the type from the dropdown: Email, Phone, Name, Address, Date of Birth, Company, or Custom.

3Fill in the fields that appear. For example, for "Address" you'll see Street, City, Postal Code, Country.

4Click "Encrypt & Save". Your data is encrypted in your browser using your passphrase-derived key, then the encrypted blob is stored on the server.

To view a stored credential, click "View" on its card. It's decrypted locally in your browser.

To delete one, click "Delete" and confirm.

The server only ever stores encrypted blobs. Even if the server were hacked, the attacker would get gibberish — not your actual data.

How do I share credentials with an entity (e.g. a shop)?

When a NullLink entity — like a shop, hotel, or booking assistant — needs your personal information, here's what happens:

1The entity sends a credential request through NullLink. It says something like: "BookPilot needs your name and email to confirm your appointment."

2You see a card in your vault with the request. It shows exactly what's being asked and who's asking.

3You can Approve or Deny. If you deny, nothing is shared.

4If you approve, your vault decrypts the requested credentials, re-encrypts them using the entity's public key (so only that entity can read them), and sends the sealed envelope through NullLink.

5NullLink relays the encrypted blob to the entity. NullLink cannot read it — it's like delivering a sealed letter.

6A log entry is saved in your Sharing Log tab (encrypted, only you can read it) recording what you shared, with whom, and when.

How do I set up the Authenticator App (2FA)?

Adding a TOTP authenticator gives your vault a second layer of security. You need a free app on your phone — any of these work:

Google Authenticator (iOS / Android)
Microsoft Authenticator (iOS / Android)
Authy (iOS / Android / Desktop)
Any app that supports TOTP / RFC 6238

You do not need to register with Google or Microsoft. TOTP is an open standard — the apps just generate time-based codes.

1Open your vault and go to the Authenticator tab.

2Click "Enable Authenticator".

3A QR code appears on screen. Open your authenticator app on your phone, tap "+" or "Add account", and scan the QR code.

4If scanning doesn't work, tap "Enter manually" in your app and type the manual entry key shown below the QR code.

5Save the recovery codes shown on screen. Write them down or store them in a password manager. Each code can be used once if you lose access to your phone.

6Your authenticator app now shows a 6-digit code that refreshes every 30 seconds. Type the current 6-digit code into the confirmation field and click "Confirm & Enable".

Once enabled, the authenticator adds an extra check when logging in or performing sensitive actions.

How do I back up my identity?

1Open your vault (you must be logged in).

2Click "Export Backup". A file named nlid-backup-nl_XXXX.enc downloads to your computer.

3Store this file somewhere safe: a USB drive, a cloud drive, or a password manager's file vault.

The backup file is encrypted with your passphrase. Without the passphrase, nobody can use it.

To restore: On the home screen, scroll down to "Restore from Backup", upload your .enc file, enter your passphrase, and click "Restore Identity".

I already have a NullLink account with email. Can I link my NL-ID?

Yes. Linking lets you log in with either method — email/password or NL-ID/passphrase.

1Log in to NullLink with your email and password as usual.

2Click your name in the top-right corner and select "Identity Vault".

3Create your NL-ID here (if you haven't already) or note down your existing NL-ID.

4The system will offer to link the NL-ID to your email account. Confirm it.

5From now on, you can choose either login method. Gradually, you can move away from email entirely.

What exactly does "zero-knowledge" mean?

Three guarantees:

This vault server (ids.nulllink.ch) stores only encrypted blobs. It does not know your name, email, phone number, or anything else. It cannot decrypt your data — it does not have your passphrase.
NullLink (nulllink.ch) verifies your identity by checking a cryptographic signature. It never sees your passphrase or private key. It's like showing your passport through a window — the guard can see it's valid but can't take it.
AI entities on NullLink only receive the specific credentials you explicitly share, sealed in an envelope that only they can open. NullLink's servers relay the sealed envelope but cannot read its contents.

Technical details (for developers)

Identity keypair: Ed25519 (via TweetNaCl) — 32-byte public key, 64-byte secret key
Encryption keypair: Curve25519 (NaCl box) — for E2E credential sharing
Vault encryption: XSalsa20-Poly1305 (NaCl secretbox) — 256-bit key
Key derivation: PBKDF2-SHA512, 100,000 iterations, 32-byte random salt
E2E credential sharing: NaCl box (Curve25519 key exchange + XSalsa20-Poly1305)
TOTP: HMAC-SHA1, 30-second period, 6-digit codes (RFC 6238)
NL-ID format: nl_ + 24 characters derived from SHA-512 hash of the Ed25519 public key
All cryptography runs in the browser. The server is a dumb encrypted-blob storage layer.

Discovery endpoint: /.well-known/nlid-configuration

NullLink Identity