Zero-install · Browser-based

Your EU-Wallet, in a browser tab.

Import credentials, present them to any OpenID4VP verifier, keep everything under your own control. No app-store install.

Honest about what this is. This is a hosted, browser-based wallet. It maxes out at LoA-Substantial. It is not the EUDI Wallet Instance (that’s our native iOS + Android app on the roadmap). It has no hardware-backed keys, no NFC eID enrollment, no offline / BLE-proximity presentation. What it does have: fast trial, no install, cross-device sync, and every line of EUDI-protocol code written by Aloaha Limited on Malta. Zero third-party EUDI SDKs. Zero supply-chain exposure on the trust layer.

In-house code

Every SD-JWT parse, KB-JWT sign, x5c walk, DCQL match — Aloaha-written. No eudi-lib-* in the tree.

Zero-dep browser crypto

Five audit-reviewed JS modules ship the wallet’s CBOR, COSE, mDoc, camera scanner and visual-credential renderer — no npm install, no transitive package graph, no supply-chain path from a package-of-the-day to your keys.

Non-extractable keys

Wallet keys generated by your browser’s WebCrypto, marked extractable:false. XSS can’t exfiltrate them.

OID4VP 1.0 Final

SD-JWT VC, DCQL, direct_post.jwt with JWE ECDH-ES + A128GCM — the same wire as our OIDF-conformance verifier.

Install as PWA

Add to Home Screen on iOS/Android for a native-feeling app icon + offline shell — still a hosted wallet, still under your control.

My credentials

Everything below is stored in your browser only. Deleting them here removes them from this device.

Import a credential

Paste a credential offer URL (starts with openid-credential-offer://) or an OpenID4VCI offer URI. If the issuer requires a transaction code, enter it below.

Credential offer URL or JSON

Transaction code (optional)

Or present something already there

Paste an openid4vp:// deep-link from a verifier, or scan the verifier's QR code with your camera.

openid4vp:// URL

Settings

Wallet identity

Your wallet is identified by the JWK thumbprint (RFC 7638) of the ECDSA P-256 public key generated in your browser. The private key is non-extractable: WebCrypto refuses to hand it back to any script, including this page.

Wallet Attestation JWT

A self-signed attestation (HAIP §5.11 pattern) declaring this is a hosted browser wallet, non-hardware-backed, LoA-Substantial ceiling. Downstream verifiers that need LoA-High will (correctly) reject it.

Available attestations from your profile

Verified SD-JWT VCs derivable from your OIDC profile (email-verified, phone-verified, name, date-of-birth, postal address, and more). Issued straight into this session — no QR code, no device switch.

What’s stored

SD-JWT VCs you imported (in your browser’s IndexedDB).
Your non-extractable ECDSA P-256 keypair.
Small settings (last-used tenant, UI preferences).

Nothing is synced to any Aloaha server in this MVP. Clearing your browser data or the button below removes everything from this device.

Recovery vault

Set up a recovery passphrase and (optionally) a WebAuthn passkey so you can restore this wallet on a new device. Vault is encrypted in your browser with AES-256-GCM; only ciphertext is synced to our server. If you lose all your factors, we cannot recover the vault — this is by design.

Checking vault status …

Roadmap

Phase 2: Server-side encrypted vault (password-derived KEK, Bitwarden pattern) for cross-device sync.
Phase 2: WebAuthn passkey as device-binding root of trust.
Phase 3 (native): iOS + Android app with hardware-backed keys, NFC eID enrollment, ISO 18013-5 proximity presentation, offline capability, LoA-High.

See our verifier proof-of-work · HAIP conformance evidence · /openapi.json spec