Identity, the key log and seed phrases

A Pigeon account is a set of keys, not a phone number or an email address. Nothing on a server says who you are; your devices carry the proof.

The account Built

An account is a root key and a key per device, recorded in a key event log. The design follows KERI-style pre-rotation: each root event commits to the hash of the next root key, so whoever steals the current key still can't take over the account. Every device is a full member of each conversation; there's no primary device. An account can have up to 16 active devices.

A new device is linked from an existing one by scanning a QR code, then comparing a 6-digit code shown on both screens (three tries, ten minutes). Any device can revoke another at once, and rotating the root key cuts out a lost device.

There's no account recovery through Pigeon. If you lose every device and your seed phrase, the account is gone; nobody, including us, can restore it.

The seed phrase Built

24 words from the BIP39 English wordlist (2,048 words).
The words encode the 32-byte Ed25519 seed of the account's next root key directly. There's no password-stretching step, because the phrase is already 256 bits.
An 8-bit checksum: the first byte of SHA-256("pigeon/id/v2 seed phrase" || seed). A different domain from BIP39's, so cryptocurrency wallets reject a Pigeon phrase, and Pigeon rejects a wallet phrase, in 255 cases of 256.
The phrase doesn't contain the account id.
When typing it in, the first four letters of each word are enough.

The desktop sign-up shows the phrase once and then asks you to confirm three of the words Built. Why only once: the seed phrase, shown once.

The key log (key transparency) Planned

A messenger is only as private as the keys you encrypt to. The planned key log makes it detectable if anyone, including Pigeon, shows you a fake key for someone or quietly adds a device to an account.

An insert-only sparse Merkle map of every account's key events: the first event seen for a slot wins.
A hash-chained head published per epoch (15 minutes is the proposed starting value) to a public log with no admin or upgrade key.
Each client keeps the last head it verified, checks consistency between heads, and checks that its own events are included and that nothing extra is (catching ghost devices).
Proofs travel inside MLS messages, and each message carries the sender's view of the head, so a split view shows up.
Anyone can audit by replaying the published batches.

Until it ships, the desktop alpha marks keys as “pending verification”. Who audits besides Pigeon is an open question.

Names

Pigeon names (handles) are optional: 3 to 24 characters from a-z 0-9 . _, starting with a letter, one per account, with an unlisted mode. The directory is built; the apps' connection to it is Planned. Known gap: the directory can see which name was looked up. Details: handles and lookups.

Sources: ADR-0005 (identity and handles), ADR-0003 (key transparency), docs/specs/seed-phrase-v2.md, docs/specs/handle-v1.md, docs/ui/seed-phrase-signup.md, ADR-0014 (what's in the desktop alpha).