Open Source · Zero-Knowledge Relay

Sign in to Google on
any computer you don't trust

A library terminal, a hotel business center, a friend's laptop, a work kiosk — scan a QR code with your phone and sign in without ever typing your password or leaving a session behind. The exchange is end-to-end encrypted; the relay server never sees your credentials.

Free forever · MIT License · No account required

Libraries Hotels Shared work computers IT kiosks Borrowed laptops

How it works

  1. 01

    Install the extension

    Add AuthRelay to Chrome. It watches for Google sign-in pages automatically — nothing to configure.

  2. 02

    Scan the QR code

    When a sign-in is detected, a QR code appears on the desktop. Scan it with the AuthRelay app on your phone.

  3. 03

    Approve on your phone

    Sign in with Google on your phone, where you already trust the device. The desktop browser completes sign-in the moment you approve.

The relay never sees your credentials

Your phone and desktop negotiate a fresh encryption key for every session and encrypt the OAuth callback before it ever leaves the device. The relay server only forwards ciphertext it cannot read — even if it were compromised, there's nothing usable to steal.

Sessions are ephemeral by design: they expire five minutes after creation, and nothing is persisted once a sign-in completes. The full protocol, extension, and server are MIT-licensed and open for anyone to audit on GitHub.

Key exchange
X25519 (ECDH)
Encryption
AES-256-GCM
Key derivation
HKDF-SHA256
Session lifetime
5 minutes
Server retains
Nothing, post-session
Source
MIT, on GitHub
Zero credentials on server
Fully auditable source code
Sessions expire in 5 minutes
MIT Licensed

Get AuthRelay

Install the extension on desktop, then the app on your phone.

Support the Project

AuthRelay is free and open source. If you find it useful, consider supporting development.