User Guide

The Professional user guide.

A personal TrustDID identity for individual email users. No domain or web hosting required — your DID is hosted by TrustDID.

This guide has been merged into the unified TrustDID User Guide.

The new guide covers both Professional and Business users in one place, with role-specific badges so you know exactly which sections apply to you.

TrustDID User Guide →
Who is this for?

Users whose email provider does not support hosting a did.json file. This includes Gmail, Outlook.com, Yahoo, Videotron, and most ISP email addresses. TrustDID hosts your public DID document at users.trustdid.ca/user/{your-id}/did.json so anyone can verify your signatures.

Prerequisites
  • Register online first — Register Here →
  • TrustDID Go binaries installed (zero dependencies)
  • A valid email address
  • Your API token and User ID (from registration)

Already registered? Individual Dashboard →

Contents

  1. Register & Create Your Identity
  2. What Recipients See When They Verify
  3. Install the Browser Plugin
  4. Install the Email Plugins (Optional)
  5. Signing Documents
  6. Verifying Documents
  7. Encrypting & Decrypting
  8. Removing Your Profile
  9. Your DID — How It Works
  10. Script Reference
Step 1

Set Up Your Identity

After registering via the web enrollment and receiving your API token and User UUID, run the setup command:

Managed setup (recommended)

One command — use the API token and ID from your enrollment completion page. Your account type is detected from the token automatically:

trustdid-setup --managed YOUR_TOKEN YOUR_ID

The setup will:

  1. Validate your token with the TrustDID server
  2. Generate Ed25519 + X25519 + ML-DSA-44 key pairs
  3. Create and auto-publish your DID document
  4. Save your configuration to ~/.trustdid/config.json
Token storage.

Your registration token is automatically saved in config.json under your profile's registrationToken field. This token is used for publishing DID updates and removing your profile from the server.

On completion, the following files are created:

~/.trustdid/
  config.json                   ← signing configuration
  user/
    {uuid}/
      did.json                  ← your DID document (published online)
  keys/
    {uuid}/
      signing.pem               ← Ed25519 private key (keep secret!)
      signing.pub
      encryption.pem            ← X25519 private key (keep secret!)
      encryption.pub
      signing_pq.pem            ← ML-DSA-44 secret key (keep secret!)
      signing_pq.pub
    backup/
      trustdid_backup_*.tar.gz
Store the backup archive in a secure, offline location. Your private keys are the only way to sign documents and decrypt files sent to you.
Step 2

What Recipients See When They Verify

When someone verifies a document you signed, the verifier answers two independent questions: Document authenticity — is it genuine? (Verified / Inconsistent / Failed / Unsigned) — and Trusted signer — who vouches for it? (Yes / No / Unknown, answered against the trust registries the verifier relies on). The math tells you it's genuine — people tell you whether to trust it.

TrustDID Document Verification
==============================
  Signer:    did:web:users.trustdid.ca:user:52ab2c63#active
  Timestamp: 2026-08-12T14:03:22Z

  Document authenticity   Verified
  Trusted signer          Yes
    Authentic and trusted
Hosting is not endorsement.

Your hosted identity lives on the dedicated domain users.trustdid.ca. TrustDID hosting your identity does not by itself vouch for you — a "Trusted signer: Yes" answer comes from trust registries that list you. A perfectly authentic document from a signer the recipient's registries don't list shows "Trusted signer: No", and that is a normal, honest outcome, not a failure.

Step 3

Install the Browser Plugin

The TrustDID browser extension for Chrome, Edge, and Firefox lets you verify signed web pages and documents, and sign emails in Gmail directly from your browser.

Chrome / Edge

  1. Open Chrome or Edge and navigate to chrome://extensions/ (or edge://extensions/)
  2. Enable Developer mode (toggle in the top-right corner)
  3. Click Load unpacked
  4. Select the extracted chrome-edge/ folder from the downloads page
  5. The TrustDID icon appears in your browser toolbar

Firefox

  1. Open Firefox and navigate to about:debugging#/runtime/this-firefox
  2. Click Load Temporary Add-on...
  3. Select manifest.json from the extracted firefox/ folder
  4. The TrustDID icon appears in your browser toolbar
  5. For permanent install: about:addons > gear > Install Add-on From File

When you visit a page that has a .vrfy file, click the TrustDID icon to verify the page's authenticity and see the signer's identity. In Gmail, the extension adds sign and verify buttons directly in the compose and read views.

Step 4 (Optional)

Install Email Plugins

The Outlook and Thunderbird plugins enable automatic email signing and one-click verification for received emails. They require the TrustDID local service.

Start the Local Service

# Windows: install as a service (requires admin)
trustdid-service install
trustdid-service start

# Any platform: run in foreground
trustdid-service run

Outlook Add-in

  1. Open Outlook and go to Get Add-ins (or Store)
  2. Click My add-ins → Add a custom add-in → Add from file
  3. Select manifest.xml from the extracted Outlook zip
  4. The TrustDID panel appears in your compose and read windows

Thunderbird Extension

  1. Open Thunderbird → Add-ons and Themes (Ctrl+Shift+A)
  2. Click the gear icon → Install Add-on From File...
  3. Select the downloaded .xpi file
  4. Click Add when prompted, then configure in Add-ons > TrustDID > Options

Once installed, outgoing emails are automatically signed with your TrustDID identity, and received signed emails can be verified with one click.

Step 5

Signing Documents

Sign any file — your email identity works exactly like a company identity for signing:

# Basic signing
trustdid-sign report.pdf

# With reason and location
trustdid-sign contract.pdf --reason "Agreement review" --location "Montreal, QC"

# GUI mode
trustdid-sign invoice.pdf --tui

This produces a .vrfy verification manifest. Send both the original file and the .vrfy file to your recipient.

report.pdf           ← original document (unchanged)
report.pdf.vrfy      ← verification manifest (send both)

Your signature contains:

  • Ed25519 cryptographic signature (proves you signed it)
  • ML-DSA-44 post-quantum signature (quantum-safe)
  • Your DID (did:web:users.trustdid.ca:user:{uuid})
  • Timestamp, file hash, and metadata
Argument Description
document Path to file to sign (required)
--reason, -r Reason for signing (optional)
--location, -l Location information (optional)
--tui Show GUI progress window
Step 6

Verifying Documents

Verify a signed document received from anyone — no keys or account needed:

# Verify a document (auto-detects .vrfy file)
trustdid-verify contract.pdf

# TUI mode (animated terminal UI)
trustdid-verify contract.pdf --tui

# Output result as JSON
trustdid-verify contract.pdf --json

The verifier fetches the signer's public key from their DID, verifies the cryptographic signature, and reports the result — all locally on your computer. No documents are ever uploaded.

Argument Description
document Path to document to verify (required)
signature Path to .vrfy file (optional, auto-detected)
--tui Interactive terminal UI with animated verification steps
--json Output result as JSON
--skip-hash Skip document hash check (email body verification)
Step 7

Encrypting & Decrypting

Send encrypted files that only the intended recipient can read:

# Encrypt a file for a recipient
trustdid-encrypt confidential.pdf recipient@example.com

# Specify which encryption key to use
trustdid-encrypt report.pdf alice@example.com --key active-encrypt

# GUI mode
trustdid-encrypt --tui

Send the two output files to the recipient:

confidential.pdf.enc   ← encrypted data
confidential.pdf.meta  ← encryption metadata

When you receive encrypted files, decrypt them:

# Auto-detect profile from .meta
trustdid-decrypt confidential.pdf.enc

# GUI mode
trustdid-decrypt --tui
trustdid-encrypt
document File to encrypt
email Recipient email address
--key, -k Recipient key ID (skips interactive selection)
--tui GUI mode
trustdid-decrypt
encrypted Encrypted .enc file
metadata .meta file (optional, auto-detected)
--profile, -p Local profile for decryption (auto-detected from .meta)
--tui GUI mode

Removing Your Profile

To remove your email identity and delete the remote DID document from users.trustdid.ca:

# Remove by email address (uses stored token)
trustdid-setup --remove you@example.com

# Remove by UUID
trustdid-setup --remove 52ab2c63

The removal process:

  1. Deletes the remote registration and DID document from users.trustdid.ca
  2. Removes the profile from local config.json
  3. Cleans up local DID document and email mappings
Local key files are preserved.

The --remove command does not delete your private keys from ~/.trustdid/keys/. Previously signed documents remain verifiable even after removal, but no new signatures can be published.

Lost your token?

If the token was not stored in config.json (older versions), supply it manually with --token YOUR_TOKEN. If the token is lost entirely, contact TrustDID IT to remove the server-side profile via the admin panel.

Your DID — How It Works

Your TrustDID email identity creates a DID that looks like this:

did:web:users.trustdid.ca:user:52ab2c63

This resolves to a publicly accessible DID document at:

https://users.trustdid.ca/user/52ab2c63/did.json
What does this mean?
  • did:web: — the DID method (web-based, no blockchain)
  • users.trustdid.ca — the dedicated domain for hosted individual identities (TrustDID hosts it for you)
  • :user:52ab2c63 — your unique 8-character identifier

Share your DID with anyone who needs to verify your documents or send you encrypted files. They can look up your public keys anytime at the URL above.

Your private keys never leave your computer.

Only the public keys are published in the DID document. Your signing and encryption private keys stay in ~/.trustdid/keys/ on your machine. TrustDID never has access to your private keys.

Script Reference

Command Purpose Key Arguments
trustdid-setup Create / remove identity --managed, --remove, --pull
trustdid-sign Sign any document document, --reason, --location, --tui
trustdid-verify Verify a signed document document, --tui, --json, --skip-hash
trustdid-encrypt Encrypt for a recipient document, email, --key, --tui
trustdid-decrypt Decrypt a received file encrypted, --profile, --tui
trustdid-service Local service for Outlook plugin run/install/start/stop

You're all set. You now have a self-sovereign digital identity tied to your email address — with document signing, encryption, and post-quantum cryptography built in.

One identity, every inbox.

Get Early Access Full User Guide