WebeSign
Your PIN never passes through the browser
The PIN is typed in the app or in the operating system window, never in a web page and never in the extension.
Free and Open Source
Use your smart card, USB token, or OS certificate to sign on any website.
Works with Chrome, Edge, Firefox, Opera, Brave and Safari on Windows, macOS, and Linux. Free and Open Source for everyone.
Prerelease builds are not code-signed yet, so Windows and macOS warn once. Every file has a published checksum.
WebeSign runs on computers with Windows, macOS or Linux. Open this page on your computer to install it.
How it works
The website never touches your keys. Everything that involves your certificate happens on your computer, in a window you control.
1
The website
Prepares the document and sends only its hash, a short fingerprint. The document stays with the site.
On your computer: the PIN never leaves it
2
The extension
Passes the request from the browser to the WebeSign app. It never sees your PIN or your keys.
3
The WebeSign app
Shows who is asking and a verification code. You choose the certificate and confirm.
4
Your system or token
Windows, macOS or the token driver signs the hash. If a PIN is needed, you type it there.
The signature and your public certificate go back to the website, which builds the signed document.
The document never leaves the website. Any signature format, for any country, can be built on top: PAdES, CAdES, XAdES, JAdES.
Works where you do
No list of approved models: if your operating system or your token's driver can use a certificate, WebeSign can sign with it.
Browsers
- Chrome
- Edge
- Firefox
- Opera
- Brave
- Safari
Operating systems
- Windows
- macOS
- Linux
Certificates
- Smart cards
- USB tokens
- Installed certificates
Status per browser, system and device, including what is still being tested: compatibility table
What we promise
Each website needs your permission
A website sees nothing about your certificates until you allow it, and you can revoke that at any time in the app.
Every signature asks you first
Even for a website you allowed, each signature opens the app's window with a verification code you can compare with the site.
Only a hash is exchanged
The app receives a fingerprint of the document, not the document. Nothing runs in the background and no network port is opened.
Questions
Is it really free?
Yes, for everyone, with no account. The app and the extension are free software (GPL-3.0-or-later); the libraries for developers are Apache-2.0, so any website or program can use them.
Which certificates work?
Any certificate your operating system or your token's driver can use: USB tokens, smart cards and certificates installed on the computer (for example from a .pfx file). There is no list of approved models.
Can a website see my PIN, my keys or my other certificates?
No. The PIN is typed in the app or the system window, and the private key never leaves your computer or your token. A website only receives the certificate you choose and the signature you confirm.
Why do Windows and macOS warn when I install it?
Prerelease builds are not code-signed yet. The download page says what to click, and how to check each file against the published SHA256SUMS.
Which signature formats does it support?
WebeSign returns a raw signature and the certificate; the website builds the format it needs (PAdES, CAdES, XAdES or JAdES), for any country's rules.
Does it work on phones?
No. WebeSign runs on computers with Windows, macOS or Linux, where tokens and smart cards are plugged in.
Is something always running in the background?
No. The browser starts the app only when a website asks for a signature, and the app opens no network port.