Post-quantum · NIST FIPS 204 · Hybrid Ed25519 + ML-DSA-65

Your identity has
a heartbeat.

Passwordless. Tokenless. Post-quantum. Sovereign. Replace passwords, JWTs, OAuth tokens, and sessions with per-request signed proofs bound to a key in your hardware enclave. One line of middleware. Every major language.

How it works

One line on the server.
One line on the client.

No login screen. No logout button. No session middleware. No CSRF tokens. Every request carries its own cryptographic proof, bound to URL and body, rejected if replayed against anything else.

import { pulse } from '@pulse/server';

app.use('/api', pulse.verify({
  appId: 'mybank.com',
  minTier: 'civilian',
  defaultMinTrust: 0.7,
}));

app.post('/api/transfer',
  pulse.requireTrust(0.95),
  (req, res) => res.json({ ok: true }),
);
from pulse import PulseVerifier

pulse = PulseVerifier(
    app_id="mybank.com",
    min_tier="civilian",
)

@app.post("/api/transfer")
async def transfer(body, identity = Depends(pulse.require(min_trust=0.95))):
    return {"ok": True}
import "github.com/pulse-protocol/pulse-go"

verifier := pulse.NewVerifier(pulse.Options{
    AppID:    "mybank.com",
    MinTier:  pulse.TierCivilian,
    MinTrust: 0.7,
})

router.Use(verifier.Middleware())
router.POST("/api/transfer",
    verifier.RequireTrust(0.95),
    transferHandler,
)
@Configuration
public class PulseConfig {
  @Bean
  public PulseVerifier pulseVerifier() {
    return PulseVerifier.builder()
      .appId("mybank.com")
      .minTier(Tier.CIVILIAN)
      .defaultMinTrust(0.7f)
      .build();
  }
}

@PostMapping("/api/transfer")
@RequireTrust(0.95f)
public ResponseEntity<?> transfer(...) { ... }
use pulse_axum::PulseLayer;

let app = Router::new()
    .route("/api/transfer", post(transfer))
    .layer(PulseLayer::new("mybank.com")
        .min_tier(Tier::Civilian)
        .default_min_trust(0.7));

async fn transfer(identity: PulseIdentity) -> impl IntoResponse {
    // identity.pubkey_id, identity.tier, identity.trust_score
}
using Pulse.AspNetCore;

builder.Services.AddPulse(opts => {
    opts.AppId = "mybank.com";
    opts.MinTier = Tier.Civilian;
    opts.DefaultMinTrust = 0.7;
});

app.UsePulse("/api");

app.MapPost("/api/transfer", [RequireTrust(0.95)] (PulseIdentity id) =>
    Results.Ok(new { ok = true })
);
import { Pulse } from '@pulse/web';

const pulse = await Pulse.init({ app: 'mybank.com' });

if (!await pulse.isEnrolled()) {
  await pulse.enroll({ biometric: 'auto' });
}

const res = await pulse.fetch('/api/transfer', {
  method: 'POST',
  body: JSON.stringify({ amount: 100 }),
  minTrust: 0.95,
});
import Pulse

let pulse = try await Pulse(appId: "mybank.com")

if !pulse.isEnrolled {
    try await pulse.enroll(using: .faceID)
}

let (data, _) = try await pulse.data(
    for: request,
    minTrust: 0.95
)
val pulse = Pulse.init(context, appId = "mybank.com")

if (!pulse.isEnrolled()) {
    pulse.enroll(BiometricPrompt.FINGERPRINT)
}

val response = pulse.fetch(url) {
    method = "POST"
    body = json
    minTrust = 0.95f
}
final pulse = await Pulse.init(appId: 'mybank.com');

if (!await pulse.isEnrolled()) {
  await pulse.enroll();
}

final res = await pulse.fetch(
  Uri.parse('/api/transfer'),
  method: 'POST',
  body: jsonEncode({'amount': 100}),
  minTrust: 0.95,
);
import { Pulse } from '@pulse/react-native';

const pulse = await Pulse.init({ app: 'mybank.com' });

if (!await pulse.isEnrolled()) {
  await pulse.enroll();  // Secure Enclave / StrongBox
}

const res = await pulse.fetch(url, { method: 'POST', body, minTrust: 0.95 });

What Pulse deletes from your stack

Less code. Less surface area. Fewer breaches.

Passwords
JWTs
OAuth dance
Refresh tokens
Sessions
Cookies
MFA codes
SMS OTPs
Magic links
"Remember me"
CSRF tokens
Password resets
Bearer tokens
Session storage
Account takeover ML
Passwords
JWTs
OAuth dance
Refresh tokens
Sessions
Cookies
MFA codes
SMS OTPs
Magic links
"Remember me"
CSRF tokens
Password resets
Bearer tokens
Session storage
Account takeover ML

Why Pulse

Built for the next decade of identity.

Unphishable

Every proof is cryptographically bound to URL + body hash. A stolen proof works nowhere else.

Post-quantum

Hybrid Ed25519 + ML-DSA-65 (NIST FIPS 204) signatures. Crypto-agile by design.

Sovereign

Your root identity is yours. Generated on your device. Revocable only by you. No issuer.

Universal

Same protocol from consumer apps to nation-state. Civilian → Enterprise → National → Strategic.

Standards-composed

WebAuthn, CBOR, COSE, FIPS 204, DPoP-style binding. Built on what your security team trusts.

CC0 forever

Public domain. No company, no government can capture it. Business is verifier infra, not the spec.

vs. the alternatives

Pulse against what you have today.

Same browser, same backend, same UX — strictly stronger security.

Passwords + JWT OAuth 2.0 + DPoP Passkeys (WebAuthn) Pulse
Phishing-resistantpartial✓ (URL+body bound)
Token theft = compromiseyesyesn/ano token exists
Per-request signed proof✗ (login only)
Post-quantum (today)✓ ML-DSA-65 hybrid
Server stores PIIyesyespubkey onlypubkey only
Works offline / mesh✓ (v0.3)
Universal across tiers✓ civilian → strategic
Spec licensevariousIETFW3C / FIDOCC0 / Public Domain

Languages

One Rust core. Every major language.

Idiomatic SDKs generated from a single cryptographic core via UniFFI, NAPI-RS, PyO3, wasm-bindgen, jni-rs, and cbindgen. One audit. No drift. No reinvented bugs.

Rust

Native. The source of truth.

TypeScript / Node

NAPI-RS native addon, 5–10× faster than WASM.

JS / Browser

wasm-bindgen. Works in every browser.

Python

PyO3 + maturin. FastAPI, Django, Flask.

Go

cbindgen + cgo. chi, gin, net/http.

Java / Kotlin

jni-rs. Spring Boot starter included.

Swift

UniFFI. SwiftPM. iOS + macOS.

Kotlin / Android

UniFFI. StrongBox-backed.

C / C++

cbindgen. For firmware + embedded.

.NET / C#

P/Invoke. ASP.NET + minimal APIs.

Ruby

UniFFI. Rails middleware.

Elixir

Rustler NIF. Phoenix middleware.

Stop typing passwords.
Start signing intent.

The repo is open. The spec is short. The principles are non-negotiable. Come tear it apart.