Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
SQRL
open-in-new
<h2 id="history">History</h2> <p>The <a href="/facts/Acronym/nlHK7aRt">acronym</a> SQRL was coined by Steve Gibson and the protocol drafted, discussed and analyzed in-depth, by himself and a community of <a href="/facts/Internet_security/LeTm8Wx4">Internet security</a> <a href="/facts/Enthusiasts/z2TnXR6t">enthusiasts</a> on the news.grc.com <a href="/facts/Newsgroups/282rotmp">newsgroups</a> and during his weekly <a href="/facts/Podcast/arkeh0YV">podcast</a>, <i><a href="/facts/Security_Now/Gkf2qqGG">Security Now!</a></i>, on October 2, 2013. Within two days of the airing of this podcast, the <a href="/facts/W3C/lGWmhF6M">W3C</a> expressed interest in working on the standard.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> </p><p><a href="/facts/Google_Cloud_Platform/lPTNk7l6">Google Cloud Platform</a> developers Ian Maddox and Kyle Moschetto mentioned SQRL in their document "Modern Password Security for System Designers".<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> </p><p>A thesis on SQRL analyzed and found that "it appears to be an interesting approach, both in terms of the envisioned user experience as well as the underlying cryptography. SQRL is mostly combining well established cryptography in a novel way."<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a> </p> <h2 id="benefits">Benefits</h2> <p>The protocol is an answer to a problem of <a href="/facts/Online_identity/BmvkpFhE">identity</a> <a href="/facts/Fragmentation_(programming)/6hhNM4Pn">fragmentation</a>. It improves on protocols such as <a href="/facts/OAuth/gIu2zsv1">OAuth</a> and <a href="/facts/OpenID/Vpx5mbcV">OpenID</a> by not requiring a <a href="/facts/Third-party_verification/7AaCMwWH">third party</a> to broker the transaction, and by not giving a server any secrets to protect, such as username and password. </p><p>Additionally, it provides a standard that can be freely used to simplify the login processes available to <a href="/facts/Password_manager/NUJzIXPR">password manager</a> applications. More importantly, the standard is open so no one company can benefit from owning the technology. According to Gibson's website,<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> such a robust technology should be in the public domain so the security and cryptography can be verified, and not deliberately restricted for commercial or other reasons. </p> <h3>Phishing protections</h3> <p>SQRL has some design-inherent and intentional <a href="/facts/Phishing/hvgfz4U8">phishing</a> defenses,<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> but it is mainly intended to be for authentication, not anti-phishing, despite having some anti-phishing properties.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> </p> <h2 id="example-use-case">Example use case</h2> <p>For the protocol to be used on a website, two components are necessary: an <a href="/facts/Implementation/IH1KXgP3">implementation</a>, that is part of the <a href="/facts/Web_service/qxrwqB3D">web service</a> to which the implementation authenticates, which displays a <a href="/facts/QR_code/B0l0IS7a">QR code</a> or specially crafted <a href="/facts/URL/pPD5g7Wq">URL</a> according to the <a href="/facts/Specifications/xEMUsktp">specifications</a> of the protocol, and a <a href="/facts/Browser_plugin/jzkeh57V">browser plugin</a> or a <a href="/facts/Mobile_application/r7vp6meo">mobile application</a>, which can read this code in order to provide secure authentication.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> </p><p>The SQRL client uses <a href="/facts/One-way_function/rGtcumDW">one-way functions</a> and the user's single master password to decrypt a secret master key, from which it generates – in combination with the site domain name and optionally an additional sub-site identifier: e.g., example.com, or example.edu/chessclub – a (sub-)site-specific <a href="/facts/Public-key_cryptography/gowoFTxS">public/private key pair</a>. It signs the <a href="/facts/Authentication_token/0V55fErB">transaction tokens</a> with the private key and gives the public key to the site, so it can verify the encrypted data. </p><p>There are no "<a href="/facts/Shared_secret/ATRz7LXy">shared secrets</a>" which a compromise of the site could expose to allow attacks on accounts at other sites. The only thing a successful attacker could get, the public key, would be limited to verifying signatures that are only used at the same site. Even though the user unlocks the master key with a single password, it never leaves the SQRL client; the individual sites do not receive any information from the SQRL process that could be used at any other site. </p> <h2 id="sqrl-implementations">SQRL implementations</h2> <p>A number of <a href="/facts/Proof-of-concept/1YzUH8LJ">proof-of-concept</a> implementations have been made for various platforms. </p> <h3>For the server</h3> <ul><li><a href="/facts/C_Sharp_(programming_language)/UC2gxeyb">C# .NET</a><a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a><a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a></li> <li><a href="/facts/Drupal/pX3JIDD3">Drupal</a><a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a></li> <li><a href="/facts/Go_(programming_language)/oWlsmAFJ">Go</a><a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a></li> <li><a href="/facts/PHP/02Lfe6RM">PHP</a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a></li> <li><a href="/facts/Python_(programming_language)/YbuGqofa">Python</a><a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a></li> <li><a href="/facts/WordPress/mrrCX1Fx">WordPress</a><a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a></li></ul> <h3>For the client</h3> <ul><li><a href="/facts/Android_(operating_system)/nNyHb0xz">Android</a><a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a><a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a><a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a></li> <li><a href="/facts/C_Sharp_(programming_language)/UC2gxeyb">C# .NET</a><a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a></li> <li><a href="/facts/IOS/mK5cggH5">iOS</a><a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a></li> <li><a href="/facts/Java_(programming_language)/9ScgFyAL">Java</a><a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a></li> <li><a href="/facts/Python_(programming_language)/YbuGqofa">Python</a><a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a></li> <li><a href="/facts/Rust_(programming_language)/8JNMV19F">Rust</a></li></ul> <h3>For the browser</h3> <ul><li><a href="/facts/Firefox/xez2zv8H">Firefox</a><a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a></li></ul> <p>There are also various server-end test and debugging sites available.<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a><a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a> </p> <h2 id="legal-aspects">Legal aspects</h2> <p>Steve Gibson states that SQRL is "open and free, as it should be", and that the solution is "unencumbered by patents".<a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a> After SQRL brought a lot of attention to QR-code-based authentication mechanisms, the suggested protocol was said by blogger Michael Beiter to have been patented earlier and thus not generally available for royalty-free use.<a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a>[<i>non-primary source needed</i>] The patent in question (not expiring until 2030) was applied for by and granted to Spanish company GMV Soluciones Globales Internet SA (a division of the Madrid-based technology and aerospace corporation <a href="/facts/GMV_Innovating_Solutions/B8RCMVg5">GMV Innovating Solutions</a>), between 2008 and 2012 by the patent offices of the United States, the European Union, Spain, and Portugal.<a class="footnote-ref" id="fnref:28" href="#fn:28"><sup>28</sup></a> </p><p>Gibson responded: "What those guys are doing as described in that patent is completely different from the way SQRL operates, so there would be no conflict between SQRL and their patent. Superficially, anything that uses a 2D code for authentication seems 'similar' ... and superficially all such solutions are. But the details matter, and the way SQRL operates is entirely different in the details."<a class="footnote-ref" id="fnref:29" href="#fn:29"><sup>29</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/WebAuthn/Bu7IuVE7">WebAuthn</a></li> <li><a href="/facts/BrowserID/NXe2aL2l">BrowserID</a></li> <li><a href="/facts/Central_Authentication_Service/29qQ65Tu">Central Authentication Service</a></li> <li><a href="/facts/Information_Card/PbMt5aH7">Information Card</a></li> <li><a href="/facts/Light-weight_Identity/LFQbtr50">Light-weight Identity</a></li> <li><a href="/facts/OAuth/gIu2zsv1">OAuth</a></li> <li><a href="/facts/OpenID_Connect/Vpx5mbcV">OpenID Connect</a></li> <li><a href="/facts/Single_sign-on/qqqLoB8h">Single sign-on</a></li> <li><a href="/facts/WebID/bBX6QrEe">WebID</a></li> <li><a href="/facts/FIDO_Alliance/MJWesQXW">FIDO Alliance</a></li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://www.grc.com/sqrl/sqrl.htm">SQRL homepage</a> at <i>GRC.com</i></li> <li>Brinkmann, Martin (October 9, 2013). <a href="http://www.ghacks.net/2013/10/09/sqrl-may-improve-website-login-authentication-process/">"How SQRL may improve the website login and authentication process"</a>. <i>GHacks.net</i>. Retrieved March 7, 2021.</li> <li>Lambert, Patrick (2013). <a href="https://www.techrepublic.com/blog/it-security/sqrl-a-new-method-of-authentication-with-qr-codes/">"SQRL: A new method of authentication with QR codes"</a>. <i><a href="/facts/Tech_Republic/SVMDVCMM">Tech Republic</a></i>. Retrieved March 7, 2021.</li> <li>Holmlund, Daniel (January 3, 2014). <a href="https://www.youtube.com/watch?v=WHFaiUc7Qwk&index=71&list=PLAIXSzgkhDs63Re9ir_drprptDpVzVcGW">"Authentication Without Passwords Implementing SQRL"</a>. <i>2014 HTML5 Developer Developer Conference</i>. Silicon Valley International Game Developers Association. Retrieved March 8, 2021 – via YouTube.</li> <li></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Gibson, Steve (2020). "Secure Quick Reliable Login: A highly secure, comprehensive, easy-to-use replacement for usernames, passwords, reminders, one-time-code authenticators ... and everything else". GRC.com. Gibson Research Corporation. Retrieved March 7, 2021. Open & free, as it should be: The component techniques and technologies employed by this solution are all well known, well tested, well understood, unencumbered by patents, and exist in the public domain. ... With this publication of every detail, I hereby release and disclaim any and all proprietary rights to any new ideas developed and presented herein. This work is thereby added to the public domain. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Gibson, Steve (October 9, 2013). "SQRL Q&A #176 (Transcript)". Security Now!. Gibson Research Corporation. Retrieved October 16, 2013 – via GRC.com. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>Maddox, Ian; Moschetto, Kyle (2019). "Modern Password Security for System Designers" (PDF). Cloud.Google.com. Retrieved March 7, 2021. <a href="https://cloud.google.com/solutions/modern-password-security-for-system-designers.pdf" target="_blank">https://cloud.google.com/solutions/modern-password-security-for-system-designers.pdf</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Babioch, Karol (May 15, 2014). Kittel, Thomas (ed.). Security Analysis and Implementation of the SQRL Authentication Scheme (BSc). IT Security, Department of Informatics, Technical University of Munich. Archived from the original on March 5, 2016. Retrieved March 18, 2015. English-language abstract; full text of original German paper, "Sicherheitsanalyse und Implementierung des Authentifikationsverfahrens SQRL", does not appear to be available. <a href="https://web.archive.org/web/20160305153938/https://www.sec.in.tum.de/finished-work/publication/318" target="_blank">https://web.archive.org/web/20160305153938/https://www.sec.in.tum.de/finished-work/publication/318</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>Gibson, Steve (2020). "Secure Quick Reliable Login: A highly secure, comprehensive, easy-to-use replacement for usernames, passwords, reminders, one-time-code authenticators ... and everything else". GRC.com. Gibson Research Corporation. Retrieved March 7, 2021. Open & free, as it should be: The component techniques and technologies employed by this solution are all well known, well tested, well understood, unencumbered by patents, and exist in the public domain. ... With this publication of every detail, I hereby release and disclaim any and all proprietary rights to any new ideas developed and presented herein. This work is thereby added to the public domain. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Gibson, Steve (2014). "Revolutionizing Website Login and Authentication with SQRL". DigiCert Security Summit. Retrieved March 7, 2021 – via Vimeo. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Gibson, Steve (December 6, 201). "How SQRL Can Thwart Phishing Attacks". GRC.com. Gibson Research Corporation. Retrieved March 7, 2021. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>"CAS - SQRL Authentication". unicon.github.io. Retrieved 2025-06-03. <a href="https://unicon.github.io/cas/development/protocol/SQRL-Protocol.html" target="_blank">https://unicon.github.io/cas/development/protocol/SQRL-Protocol.html</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"jestin/SqrlNet". April 9, 2020. Retrieved 2025-06-03 – via GitHub. <a href="https://github.com/jestin/SqrlNet" target="_blank">https://github.com/jestin/SqrlNet</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>"TechLiam/SQRL-For-Dot-Net-Standard". November 1, 2020. Retrieved 2025-06-03 – via GitHub. <a href="https://github.com/TechLiam/SQRL-For-Dot-Net-Standard" target="_blank">https://github.com/TechLiam/SQRL-For-Dot-Net-Standard</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"Secure QR Login". Drupal.org. October 4, 2013. Retrieved 2025-06-03. <a href="https://www.drupal.org/project/sqrl" target="_blank">https://www.drupal.org/project/sqrl</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>Loader, Ryan (2021-04-29), SQRL, retrieved 2022-10-30 <a href="https://github.com/RaniSputnik/sqrl-go" target="_blank">https://github.com/RaniSputnik/sqrl-go</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"trianglman/sqrl". 2025-06-03. January 9, 2021 – via GitHub. <a href="https://github.com/trianglman/sqrl" target="_blank">https://github.com/trianglman/sqrl</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Pinkney, Brian (2022-06-15), pySQRL, retrieved 2022-10-30 <a href="https://github.com/bushxnyc/sqrl" target="_blank">https://github.com/bushxnyc/sqrl</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>Persson, Daniël. "SQRL Login – WordPress plugin". WordPress.org. Retrieved 2025-06-03. <a href="https://wordpress.org/plugins/sqrl-login/" target="_blank">https://wordpress.org/plugins/sqrl-login/</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>"geir54/android-sqrl". 2025-06-03. January 25, 2021 – via GitHub. <a href="https://github.com/geir54/android-sqrl" target="_blank">https://github.com/geir54/android-sqrl</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Sylvester, Paul (December 25, 2014). "SQRL implementations on Android and it works!". Paul's Tech Talk. Archived from the original on April 2, 2015. Retrieved March 17, 2015. <a href="https://web.archive.org/web/20150402132412/https://www.paulstechtalk.com/2014/12/sqrl-implementations-on-android-and-it-works/" target="_blank">https://web.archive.org/web/20150402132412/https://www.paulstechtalk.com/2014/12/sqrl-implementations-on-android-and-it-works/</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>"SQRL on Google Play". Google Play. Archived from the original on 2015-03-17. Retrieved 2015-03-17. <a href="https://archive.ph/YivWn" target="_blank">https://archive.ph/YivWn</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>"jestin/SqrlNet". April 9, 2020. Retrieved 2025-06-03 – via GitHub. <a href="https://github.com/jestin/SqrlNet" target="_blank">https://github.com/jestin/SqrlNet</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> <li id="fn:20"><p>Stidard, James (2022-06-22), Stash iOS, retrieved 2022-10-30 <a href="https://github.com/jamesstidard/Stash-iOS" target="_blank">https://github.com/jamesstidard/Stash-iOS</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li> <li id="fn:21"><p>"TheBigS/SQRL · GitHub". GitHub. Archived from the original on 2015-03-17. Retrieved 2015-03-17. <a href="https://github.com/TheBigS/SQRL" target="_blank">https://github.com/TheBigS/SQRL</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li> <li id="fn:22"><p>"bushxnyc/sqrl". September 2, 2020. Retrieved 2025-06-03 – via GitHub. <a href="https://github.com/bushxnyc/sqrl" target="_blank">https://github.com/bushxnyc/sqrl</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li> <li id="fn:23"><p>"SQRL – Get this Extension for 🦊 Firefox (en-US)". addons.mozilla.org. Retrieved 2022-10-30. <a href="https://addons.mozilla.org/en-US/firefox/addon/sqrl/" target="_blank">https://addons.mozilla.org/en-US/firefox/addon/sqrl/</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li> <li id="fn:24"><p>"GRC | SQRL Secure Quick Reliable Login Demonstration". www.grc.com. Retrieved 2025-06-03. <a href="https://www.grc.com/sqrl/demo.htm" target="_blank">https://www.grc.com/sqrl/demo.htm</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li> <li id="fn:25"><p>"GRC | SQRL Secure Quick Reliable Login Diagnostic". www.grc.com. Retrieved 2025-06-03. <a href="https://www.grc.com/sqrl/diag.htm" target="_blank">https://www.grc.com/sqrl/diag.htm</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li> <li id="fn:26"><p>Gibson, Steve (2020). "Secure Quick Reliable Login: A highly secure, comprehensive, easy-to-use replacement for usernames, passwords, reminders, one-time-code authenticators ... and everything else". GRC.com. Gibson Research Corporation. Retrieved March 7, 2021. Open & free, as it should be: The component techniques and technologies employed by this solution are all well known, well tested, well understood, unencumbered by patents, and exist in the public domain. ... With this publication of every detail, I hereby release and disclaim any and all proprietary rights to any new ideas developed and presented herein. This work is thereby added to the public domain. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li> <li id="fn:27"><p>Beiter, Michael (October 4, 2013). "Steve Gibson's SQRL Is Not Really New". Retrieved May 12, 2014. <a href="http://www.michael.beiter.org/2013/10/04/steve-gibsons-sqrl-is-not-really-new/" target="_blank">http://www.michael.beiter.org/2013/10/04/steve-gibsons-sqrl-is-not-really-new/</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li> <li id="fn:28"><p>US patent 8261089, Leon Cobos, Juan Jesús & Celis de la Hoz, Pedro, "Method and system for authenticating a user by means of a mobile device", issued September 4, 2012, assigned to GMV Soluciones Globales Internet SA <a href="https://worldwide.espacenet.com/textdoc?DB=EPODOC&IDX=US8261089" target="_blank">https://worldwide.espacenet.com/textdoc?DB=EPODOC&IDX=US8261089</a> <a href="#fnref:28" class="footnote-back-ref">↩</a></p></li> <li id="fn:29"><p>Gibson, Steve (2020). "Other Work Related to QR Code Login". GRC.com. Gibson Research Corporation. Retrieved 22 September 2015. <a href="/wiki/Steve_Gibson_(programmer)" target="_blank">/wiki/Steve_Gibson_(programmer)</a> <a href="#fnref:29" class="footnote-back-ref">↩</a></p></li> </ol>