Speedvideodating

Signing in, start to finish

Two complete logins, one on Solana and one on Bitcoin, with every value shown and every step explained. Nothing here is illustrative: these are real exchanges, produced by running the login against this server.

The two wallets below were made for this page, used once, and hold nothing. We publish the whole exchange because the point of this scheme is that there is nothing in it that needs to be secret — and a login you can read end to end is one you can decide to trust.

Watch it, narrated

The same two logins, step by step, with a voice-over: Solana first, then Bitcoin. Captions are on, so it works with the sound off too.

About 6 minutes. Every address, challenge and signature in it is the real exchange shown on this page.

What is actually being proved

An account here is a public key and nothing else. There is no email field, no password and no reset link, because there is nothing to reset. You prove you hold a wallet by signing one short line of text with it, and that proof is the login.

That is not a style choice. The privacy page promises that nothing about you survives the session, and a password database would be a thing we kept.

Signing a message is not a transaction. It moves no coins and approves no spending. If any site ever asks you to approve a transaction in order to log in, that is not a login — refuse it.

A. Signing in with Solana

Phantom, Solflare, Backpack — anything that can sign a message.

Step 1 — your wallet tells the page its address

The browser asks the wallet to connect. The wallet shows you which site is asking and you approve it. All the site learns is a public address, which is public by definition. 

HjjxWxCBhkzkFCSRCf2PCnmkrCbkqBSQnvWoz4UJaQqx

Nothing has been signed yet and nothing has been sent to us yet.

Step 2 — the site hands out a one-time line

The page asks us for something to sign. We invent a random challenge, remember it for ten minutes, and build the sentence the wallet will display. 

POST /api/bitsign/challenge

{ "chain": "solana",
  "address": "HjjxWxCBhkzkFCSRCf2PCnmkrCbkqBSQnvWoz4UJaQqx" }

and the answer:

{ "ok": true,
  "nonce": "xGXbJHowSlGyxxOELC1A2APJUmLrAfMd",
  "message": "…" }

The nonce is the whole security of this step. It is random, it is good for one use, and it is thrown away the moment it is answered — whether the answer was right or wrong. So a signature captured in transit cannot be used a second time.

Step 3 — your wallet shows you the line, and you approve it

This is the part worth reading in your own wallet, every time, on every site. Here is exactly what it says — no hex, no blob, no code: 

speedvideodating.com — Bit-Sign

Sign in to tonight's speed dating session.
This proves you hold this wallet. It does not move any funds and it
does not approve any transaction.

Nothing you sign here is stored after the session ends.

Wallet: HjjxWxCBhkzkFCSRCf2PCnmkrCbkqBSQnvWoz4UJaQqx
Challenge: xGXbJHowSlGyxxOELC1A2APJUmLrAfMd

It is written in plain sentences deliberately. A person should be able to understand what they are approving before they approve it, and the line that stops a careful person worrying — it does not move any funds — is right there in the text being signed.

Approving produces a signature. On Solana that is ed25519, and it comes back as base58: 

4Bcg4bYhZ8nzHFT1REzqyRBcPy4Z4bxDUSyv46Ed51d7NEF4f92oVUcNYCtUTp95HxJ2b1FeHndCbMhfrpwJjroS

Step 4 — the signature comes back, and that is the login

POST /api/bitsign/verify

{ "chain": "solana",
  "address": "HjjxWxCBhkzkFCSRCf2PCnmkrCbkqBSQnvWoz4UJaQqx",
  "nonce": "xGXbJHowSlGyxxOELC1A2APJUmLrAfMd",
  "signature": "4Bcg4bYhZ8nz…rpwJjroS" }

We look up the challenge, rebuild the same sentence from it, and check the signature against the address using the public key. Either the arithmetic works or it does not; there is no judgement involved and no record to consult. 

{ "ok": true, "handle": "Quiet Dahlia 3604" }

You are in. The name is generated from the wallet, so it is the same every time you use that wallet and different if you use another. Nobody types a name here — that removes impersonation, and it removes the chance of putting your real name on a dating site by accident.

The same signature, sent twice

We tried it, immediately, with the identical body: 

{ "ok": false,
  "error": "That challenge has expired or was already used.
             Ask for a new one." }

That is the single-use rule doing its job. A signature is worth exactly one login, on the challenge it was made for, inside ten minutes.

B. Signing in with Bitcoin

Sparrow, Electrum, Trezor, BlueWallet, Coldcard — anything with Sign message. The shape is identical; only the signature format differs.

Steps 1 and 2 — your address, and a line to sign

Bitcoin wallets mostly do not connect to web pages, so you paste the address instead of approving a connection. Everything after that is the same. 

bc1qlfrjc3l6ctwtp68mhl5d0m2c0yyah5c3t6m9p6
speedvideodating.com — Bit-Sign

Sign in to tonight's speed dating session.
This proves you hold this wallet. It does not move any funds and it
does not approve any transaction.

Nothing you sign here is stored after the session ends.

Wallet: bc1qlfrjc3l6ctwtp68mhl5d0m2c0yyah5c3t6m9p6
Challenge: Ae18YGuBRieRO3rBat2O3qZLULtSH54x

Step 3 — sign it in the wallet, and copy the result

In Sparrow or Electrum this is Tools → Sign message; on a Trezor or Coldcard the line appears on the device screen and you confirm it there. Bitcoin signatures are base64 rather than base58, and shorter: 

KAzdeXNzBi6DdZfChN8+kbffrY6hhMYxhJmKkHTKE6HpEJsymDlY+4PEtyI4AL9h60IGFp4PyTAtBfY9ZvatlMk=

We accept both of the formats wallets actually emit: the modern BIP-322 form, and the older Bitcoin Signed Message form that most hardware wallets still use. The example above is the older one, which is what a Trezor produces. You do not have to know which your wallet made — we try both.

Step 4 — same endpoint, same answer

POST /api/bitsign/verify

{ "chain": "bitcoin",
  "address": "bc1qlfrjc3l6ctwtp68mhl5d0m2c0yyah5c3t6m9p6",
  "nonce": "Ae18YGuBRieRO3rBat2O3qZLULtSH54x",
  "signature": "KAzdeXNzBi6D…ZvatlMk=" }
{ "ok": true, "handle": "Velvet Wren 9975" }

With Bitcoin there is one extra nicety. The signature is recoverable: the public key is not sent at all, it is recomputed from the signature itself and then checked against the address you gave. You proved you hold the key without ever showing it to us.

What we are holding afterwards

A public address and a generated name. That is the account. The challenge was deleted when it was used, the signature is not stored, and there was never a password to lose.

At 21:00 everything from the evening is deleted anyway — see the privacy page for exactly what that covers.

Three things worth refusing, anywhere

A login that asks to approve a transaction. Signing a message is free and moves nothing. Approving a transaction can move everything. No honest site needs the second in order to log you in.

A line you cannot read. If the text in the wallet is hex, or a blob, or blank, you have no idea what you are agreeing to. Ours is four sentences and names the site.

Anyone asking for your seed phrase or private key. Nothing on this page, at any step, ever needs it. We could not use it if you sent it and we do not want it.

Prefer the short version? How an evening works covers signing in as one step among seven. Ready instead? Sign in.