Getting started
A ripoux.fr account exists only through its passphrase. It has no email and no phone number.
Create an anonymous account
On the home page, choose Create an anonymous account.
Depending on the load, registrations may be open, invite only or closed; the creation page says so before anything is typed. When invite only, a 12-character invitation code (ABCD-EFGH-JKLM) is required: get one from someone who already has an account, or from the operator. The new account remembers who invited you; see What the operator sees.
What about a collective?
Everyone creates their own account, even within a legal team, an observatory or a newsroom. The collective is then created from one of these accounts, and the others join it with an invitation link: nobody shares a passphrase.
Your identifier
An 8-character identifier is drawn at random, for example 7F3K·QM2D. It is not secret: it is only used to find your account when you sign in. Write it down with your passphrase.
1. Choose a passphrase
At least 5 unrelated words. The Suggest a random passphrase button picks one for you.
The passphrase never leaves your browser. Your key is built here, from it, by a deliberately slow function (Argon2id). The server only receives a derived value that lets it check your sign-in, not recover the passphrase.
A short or well-known passphrase can be guessed by someone who has copied the server's database. Length is your protection.
2. Write down your recovery key
A recovery key is displayed, in groups of 4 characters separated by hyphens (RX7K-2M9Q-…). It replaces your passphrase if you forget it.
It will never be displayed again. Write it on paper, away from your devices. The Copy and Print buttons exist, but a clipboard or a print queue leaves traces.
Tick I have written down my recovery key in a safe place, then Create account.
With no passphrase, no recovery key and no trusted contact, your evidence cannot be recovered. We cannot recover it for you.
Why no email
An email address often leads to a name, a provider, other accounts. Not asking for one means not being able to hand it over. It would also be used to reset a password, and there is nothing to reset here: your key is derived from your passphrase, which we do not have.
Reminders go through your browser's notifications, if you allow them. If you lose both your passphrase and your recovery key, only your trusted contacts can give you access again.
Next steps
- Add at least two trusted contacts. Together, they will be able to rebuild your key.
- Set your check-in codes.
- Allow notifications in this browser if you want to receive reminders.
- Create your first session.
Signing in
Sign in asks for the identifier and the passphrase. You stay signed in within this tab; close the tab or choose Sign out on a shared device. If a check-in is expected, signing in takes you to the check-in screen first.
Lost passphrase
With the recovery key: on the recovery page, enter your identifier and your key, then choose a new passphrase.
Without the key: the same page sends a request to your trusted contacts. See Recovering your account.
My account
The My account page (in the My space menu, top right) gathers what concerns you: an encrypted display name, the default settings of a session (recording window length, lock, sharing rule, position, discreet mode, contacts warned), which prefill "New session" and are used as is by "Record now"; the delay before the first reminder if you do not check in; the number of contacts needed to rebuild your key; and the passphrase change, which signs out your other browsers and redistributes your contacts' key shares. None of this is readable by the server.
Inviting someone
At the bottom of the Contacts page you can issue a few invitation codes (five by default), each valid for one person for 30 days. The code is shown once: hand it over in person or through a safe channel. An unused code is revoked in one click.
You are responsible for whom you invite: the operator sees the invitation tree and can remove a whole branch in case of abuse.