WebeSign

Download WebeSign

Two parts work together: the app on your computer and the extension in your browser. Install both, then finish the setup.

Prerelease builds are not code-signed yet

Windows shows SmartScreen and macOS shows Gatekeeper the first time. The steps below say what to click. Code signing is planned. Always check the SHA256SUMS file.

The repository is private for now, so downloads need the GitHub CLI signed in (gh auth login).

Install the app

Windows

The installer script checks the download, installs WebeSign for your user (no administrator rights) and connects it to your browsers. For x64 and arm64 PCs.

While the repository is private

gh release download v<v> --repo diagnos-tech/web-esign --pattern install.ps1 --pattern SHA256SUMS
# check install.ps1 against SHA256SUMS (see "Check every download"), then:
powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1 -Version <v>

Once the repository is public

$base = 'https://github.com/diagnos-tech/web-esign/releases/download/v<v>'
Invoke-WebRequest -UseBasicParsing -Uri "$base/install.ps1" -OutFile install.ps1
Invoke-WebRequest -UseBasicParsing -Uri "$base/SHA256SUMS" -OutFile SHA256SUMS

If you unzip and run websign.exe by hand, SmartScreen says “Windows protected your PC”: click More info, then Run anyway. The script avoids this prompt.

macOS

The installer script checks the download, installs WebeSign.app without sudo and connects it to your browsers. One app for Apple silicon and Intel Macs.

While the repository is private

gh release download v<v> --repo diagnos-tech/web-esign --pattern install.sh --pattern SHA256SUMS
shasum -a 256 --ignore-missing -c SHA256SUMS && sh install.sh --version <v>

Once the repository is public

curl -fsSLO https://github.com/diagnos-tech/web-esign/releases/download/v<v>/install.sh
curl -fsSLO https://github.com/diagnos-tech/web-esign/releases/download/v<v>/SHA256SUMS
shasum -a 256 --ignore-missing -c SHA256SUMS && sh install.sh --version <v>

The app is not notarized yet. If you installed it by hand and macOS says it cannot be opened, open System Settings, Privacy & Security, and click Open Anyway, or run: xattr -dr com.apple.quarantine /Applications/WebeSign.app

Linux

The installer script works on any distribution and installs for your user, without root. On Debian, Ubuntu, Fedora and Rocky Linux it can install the system package instead. For amd64 and arm64.

While the repository is private

gh release download v<v> --repo diagnos-tech/web-esign --pattern install.sh --pattern SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS && sh install.sh --version <v>

Once the repository is public

curl -fsSLO https://github.com/diagnos-tech/web-esign/releases/download/v<v>/install.sh
curl -fsSLO https://github.com/diagnos-tech/web-esign/releases/download/v<v>/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS && sh install.sh --version <v>

System packages

DistributionInstall
Ubuntu 22.04, 24.04, Debian 12sudo apt install ./websign_<v>_amd64.deb
Fedora 42, Rocky Linux 9sudo dnf install ./websign-<v>-1.x86_64.rpm
Arch Linux and othersThe installer script above

Smart cards and tokens need the PC/SC service: sudo apt install pcscd · sudo dnf install pcsc-lite · sudo systemctl enable --now pcscd.socket

Add the browser extension

The extension is not in the stores yet. From the same release, download websign-extension-<v>-chromium.zip (for Firefox: websign-extension-<v>-firefox.zip), check it against SHA256SUMS and unzip it.

Chrome

  1. Open the extensions page: chrome://extensions
  2. Turn on Developer mode.
  3. Click Load unpacked and choose the unzipped websign-extension-<v>-chromium folder.
  4. Keep that folder: the browser loads the extension from there.

Edge

  1. Open the extensions page: edge://extensions
  2. Turn on Developer mode.
  3. Click Load unpacked and choose the unzipped websign-extension-<v>-chromium folder.
  4. Keep that folder: the browser loads the extension from there.

Brave

  1. Open the extensions page: brave://extensions
  2. Turn on Developer mode.
  3. Click Load unpacked and choose the unzipped websign-extension-<v>-chromium folder.
  4. Keep that folder: the browser loads the extension from there.

Opera

  1. Open the extensions page: opera://extensions
  2. Turn on Developer mode.
  3. Click Load unpacked and choose the unzipped websign-extension-<v>-chromium folder.
  4. Keep that folder: the browser loads the extension from there.

Firefox

  1. Open this page and choose This Firefox: about:debugging
  2. Click Load Temporary Add-on and choose manifest.json in the unzipped folder.

A temporary add-on lasts until Firefox restarts. To keep it, use Firefox Developer Edition, Nightly or ESR: set xpinstall.signatures.required to false in about:config, then in about:addons choose Install Add-on From File and pick the zip.

Safari

The Safari extension comes inside WebeSign.app (macOS 13 or later, Safari 17 or later): nothing else to download. Until the app is signed by Apple, Safari loads it only with a developer setting.

  1. Install the app for macOS above and open WebeSign once from Applications, then close its window.
  2. In Safari, open Settings, Advanced, and turn on Show features for web developers.
  3. Open Settings, Developer, and turn on Allow unsigned extensions. Safari asks for your Mac password.
  4. Open Settings, Extensions, tick WebeSign and allow it on the websites where you sign.

Safari turns Allow unsigned extensions off every time it quits: repeat step 3 after each restart. Certificates in the Keychain and tokens that work with macOS behave as in other browsers; tokens that only have a PKCS#11 driver may not work in Safari yet.

The unpacked extension carries a public development key, so the app can recognize it before it is in a store. Only load the zip from our release after checking SHA256SUMS, and remove unpacked extensions you do not trust. Every signature still needs your confirmation in the app window.

Finish setting up

The installer already connected the app to your browsers. Sign a harmless test message to check that everything works. If the extension cannot find the app, open the activation page once.

Test your setup Already installed? Finish setting up

Check every download

Each release has a SHA256SUMS file. Compare the hash of your file with its line. The installer scripts do this for you.

Linux · macOS

sha256sum --ignore-missing -c SHA256SUMS        # Linux
shasum -a 256 --ignore-missing -c SHA256SUMS    # macOS

Windows (PowerShell)

$file = 'install.ps1'
$m = Select-String -Path .\SHA256SUMS -Pattern ('^([0-9a-fA-F]{64}) [ *]' + [regex]::Escape($file) + '$')
if (-not $m) { throw "${file} is not listed in SHA256SUMS" }
if ((Get-FileHash -Algorithm SHA256 -LiteralPath $file).Hash -ne $m.Matches[0].Groups[1].Value) {
  throw "Checksum mismatch for ${file}: delete it and do not run it"
}
"${file}: OK"

A mismatch means the file is damaged or was altered: delete it and do not run it.

Full guide, file names and uninstall steps: docs/install.md · All releases