SOURCE_URL: https://majikah.solutions/products/majik-signature/docs/ms-getting-started-documentation --- title: "Getting Started with Majik Signature" id: "ms-getting-started-documentation" group: "majik-signature" type: "products" version: "0.10.1" lastUpdated: "2026-09-20T00:00:00.000Z" difficulty: "Beginner" time: "10-15 minutes" tags: [getting-started, quick-start, setup, installation, beginner, onboarding, offline, post-quantum, ed25519, ml-dsa-87, seed-phrase, bip39, batch, folder, zip, document-stamping, audio-stamping, image-stamping, trusted-timestamps, tsa, multi-signature, expected-signers, allowlist, sealing, detached-signature, expiring-signature, contacts, identity-tab, windows-hello] --- # Getting Started with Majik Signature > A complete walkthrough — installation, account setup, signing, stamping, timestamps, multi-party signing and sealing, verification, and final output — for getting started with Majik Signature ## Overview Get up and running with Majik Signature from installation to your first signed file. This guide covers accessing the web app or installing the desktop app, creating your Majik Key account, signing and verifying files and text with hybrid post-quantum cryptography (Ed25519 + ML-DSA-87), and using the full feature set — document, audio, and image stamping, Detached Signing, Expiring Signatures, Trusted Timestamps, multi-party signing and sealing, and batch processing of folders and ZIP archives. Core signing and verification work entirely offline, with no account or server required. ### What is Majik Signature? Majik Signature is a hybrid post-quantum digital signature application that proves content authenticity and detects tampering. Sign virtually any file — PDFs, Office documents, images, audio, video, source code, and archives — or plain text with hybrid Ed25519 + ML-DSA-87 (NIST FIPS-204) cryptography. Every signature is produced by two independent algorithms, meaning no single algorithmic break — classical or quantum — is sufficient to forge a signature. Signatures are embedded directly into files using native metadata containers, so there are no sidecar files to manage. Beyond core signing, you can add professional document, audio, and image stamps, obtain independently signed Trusted Timestamps, keep the original file untouched with Detached Signing, set a validity window with Expiring Signatures, route documents through multi-party signing workflows with sealing, and batch sign entire folders and ZIP archives. Verification is fully public — anyone with the signer's public keys can verify a signature without needing a private key, an account, or an internet connection. > **NOTE:** Majik Signature is available as a Web App at signature.majikah.solutions, as a Windows Desktop App via the Microsoft Store, and as an npm package (@majikah/majik-signature) for developers integrating with Majik Universal ID. macOS and Linux desktop apps, a Chrome extension, and mobile apps are planned. All platforms share the same cryptographic engine and work entirely offline for core signing and verification. ### Installation 1. **Option A — Web App (No Installation Required)** *Fastest way to get started* - Open your browser and go to signature.majikah.solutions - The app loads immediately — no download, no sign-in, and no account required to begin - All cryptographic operations run locally in your browser using IndexedDB for encrypted key storage - Works on any modern desktop browser; bookmark the page for quick access 2. **Option B — Windows Desktop App** *Recommended for local filesystem integration* - Open the Microsoft Store on your Windows device - Search for Majik Signature, or go directly to its Microsoft Store listing - Click Get or Install - Once installed, launch Majik Signature from the Start menu like any other app - The desktop app offers the same interface as the web app, with local filesystem integration for drag-and-drop signing and native file dialogs - Private keys are stored encrypted on your local filesystem rather than browser storage - On Windows, you can optionally protect your account with Credential Store (face, fingerprint, or PIN) instead of typing a passphrase every time — see the account setup step below 3. **Option C — npm Package (Developers)** *For integrating signing into your own application or Majik Universal ID* - Run npm install @majikah/majik-signature in your project - If you're using Majik Universal ID, it automatically uses Majik Signature as a peer dependency for all signing and verification — no extra setup needed - Refer to the Majik Signature SDK documentation for API-level usage > **NOTE:** macOS and Linux desktop apps are coming soon (both Tauri-based, matching the Windows and web experience). Until then, macOS and Linux users can use the web app at signature.majikah.solutions. ### Account Requirement — Majik Key Seed Phrase Identity Before you can sign anything, you need a Majik Key account. This is your cryptographic identity — a BIP-39 mnemonic seed phrase (12/24-word or 24-word, in any official BIP-39 language) that deterministically derives two signing keypairs: Ed25519 (for the classical signature) and ML-DSA-87 (for the post-quantum signature). Your private keys are encrypted at rest with Argon2id and protected by your passphrase — or, on Windows, optionally by Credential Store instead of a typed passphrase (see below). As long as you have your seed phrase, you can recover your full signing capability anywhere. No email, phone number, or personal information required. This account is entirely separate from — and not required for — the optional Majikah account used for online features like Trusted Timestamps. > **NOTE:** Credential Store passwordless unlock (Windows Desktop App). Instead of typing a passphrase, you can opt in to unlocking your Majik Key with Credential Store — face, fingerprint, or PIN. Under the hood, a cryptographically random 64-byte passphrase is generated and fed into the same Argon2id protection as a typed passphrase; Credential Store simply guards access to that random secret. This is additive and best-effort — if Credential Store setup or authentication ever fails, your account keeps working through the normal passphrase flow. > **NOTE:** Core signing and verification in Majik Signature work entirely offline. All cryptographic operations happen locally on your device — no server required, no internet needed. Your private keys never leave your device and are never transmitted. An internet connection is only needed for optional online features: Trusted Timestamps (TSA) and Majikah account sign-in. ### Quick Start — Sign Your First File in 3 Steps 1. **1. Open the App** *Launch Majik Signature* - Open Majik Signature in your browser at signature.majikah.solutions, or launch the installed desktop app - No sign-in is required — the app loads immediately 2. **2. Create a Majik Key Account** *Your cryptographic signing identity* - Go to the Accounts tab (first tab in the navigation bar) - Click the plus (+) icon in the upper right corner - Enter a display name (e.g., 'My Signing Key') - Set a passphrase to protect your private keys at rest, or — on the Windows Desktop App — opt in to Credential Store to unlock with your face, fingerprint, or PIN instead - Click the dice icon next to the seed phrase field to generate a new BIP-39 mnemonic (12/24-word or 24-word, your choice) - Critical: Write down your seed phrase and store it securely offline — this is the ONLY way to recover your account. Never share it with anyone. - Click Create - Your account is now active and ready to sign 3. **3. Sign Your First File** *Embed a hybrid post-quantum signature* - Go to the Sign tab (second tab in the navigation bar) - Choose the guided Signing Wizard for a step-by-step flow, or Advanced Mode for full control including stamping and TSA options - Drag-and-drop any file onto the input panel, or click to browse — any format works (PDF, image, audio, video, document, etc.) - Your active account is automatically selected as the signer in the dropdown above the panels - Click Sign in the bottom-right footer of the input panel (or the final wizard step) - After a moment, the output panel shows the signature result with signer info, timestamp, algorithm details, and content hash - Click Download Signed File to save the file — the signature is embedded in its metadata - The signed file is the same format as the original — a signed PDF is still a PDF, a signed WAV is still a WAV, a signed PNG is still a PNG > **NOTE:** That's it! You've just created your first hybrid post-quantum signature. The file you downloaded is cryptographically signed and tamper-evident. Any byte change invalidates both the Ed25519 and ML-DSA-87 signatures. ### Signing Plain Text In addition to files, you can sign plain text or clipboard snippets. In the Sign tab, switch to Text mode using the toggle at the top of the panels. Paste or type your text in the input box. Click Sign. The output panel shows the signature result, and you get a base64-encoded detached signature that you can copy and share alongside the original text through any channel — email, messaging apps, notes, etc. ### Adding a Document Stamp (PDF, DOCX, XLSX) ![A drawn signature stamp being resized and positioned onto a PDF document within the Majik Signature application.](/articles/multi-party/majik-signature-mp-Step-3.webp) When signing a PDF, DOCX, or XLSX file in Advanced Mode, you can add a visual stamp alongside the cryptographic signature — a professional, at-a-glance mark of authenticity. In the signing panel, open the Stamp section before clicking Sign. Import an image (PNG/JPG) to use as your stamp, or draw one directly with your mouse or stylus. If you imported an image, enable chroma key to automatically remove a solid background color. Resize, rotate, and reposition the stamp on the page or sheet, and optionally add name and position text with custom font size and color. Once positioned, continue signing as usual — the stamp is layered onto the document while the underlying signature still covers the original file content. > **NOTE:** A visual stamp is a presentation layer, not a substitute for the cryptographic signature. Verification always checks the underlying Ed25519 + ML-DSA-87 signature over the original file bytes, regardless of whether a stamp is present. ### Signature Templates ![creenshot of Majik Signature's Signature Templates library showing saved handwritten signatures available for reuse.](/articles/stamp-templates.webp) > **NOTE:** Save your signature for next time. After drawing or importing a signature, look for Save as Signature to store it as a reusable Signature Template under Identity → Signatures, so you don't have to redraw or re-import it every time you sign a new document. ### Adding an Audio Stamp ![Majik Signature Audio Stamping editor showing a producer tag layered onto a track waveform.](/articles/timeline-audio-stamping.webp) When signing a WAV or other compatible audio file, you can embed a producer tag, voice signature, or branded audio watermark using the built-in multi-track audio editor. In the signing panel, open the Audio Stamp section. Import one or more audio clips to use as reusable stamps, then arrange them on the timeline. Adjust per-track volume, pan, pitch, EQ, trimming, and looping to layer multiple stamps together. Once your mix is ready, save it as a preset for reuse across future signing sessions, then continue signing — the audio stamp is embedded into the file while the cryptographic signature remains the authoritative proof of authenticity. ### Adding an Image Stamp ![Majik Signature Image Stamping interface showing a wedding photograph being configured with a watermark overlay.](/articles/batch-image-stamping.webp) When signing a PNG, JPG, WebP, or other compatible image file, you can add a logo, watermark, or branding overlay directly onto the image. In the signing panel, open the Image Stamp section and import the image you want to use as a stamp. Use Smart Anchor Placement to position the stamp relative to an anchor point (e.g., bottom-right, center) with a margin and relative size — this keeps the stamp consistently positioned even across images of different dimensions and aspect ratios. Adjust size, rotation, and placement with the on-canvas controls, then continue signing as usual. ### Batch Image Stamping To apply the same image stamp across many images at once, use Batch Image Stamping from the Sign tab. Drag-and-drop multiple image files or an entire folder, configure your stamp once using Smart Anchor Placement, and Majik Signature applies it consistently to every image in the batch — each file is still signed and stamped individually. ### Detached Signing — Keeping the Original File Untouched By default, your signature is embedded directly into the file you're signing. If you'd rather leave the original file completely unmodified — useful when a downstream system rejects files with altered metadata, or a re-encoding pipeline further down the line would strip an embedded signature anyway — toggle on Detached Signing before you sign. Instead of embedding the signature, Majik Signature produces a separate .mjksig Signature Envelope file carrying the same cryptographic proof, kept alongside your original rather than inside it. ### Expiring Signatures — Setting a Validity Window If a signature should only be considered valid for a limited period — a time-sensitive quotation, a license, an approval with a shelf life — toggle on Expiring Signature before you sign and set an expiration date and time. > **NOTE:** Worth being precise about what this actually does: once the expiration passes, anyone verifying the file afterward sees that the signature has expired instead of valid. It does not technically lock the file or prevent it from being opened or reused — it's a visible status flag at verification time, not a kill switch. ### Requesting a Trusted Timestamp (TSA) By default, Majik Signature uses a local, self-reported timestamp — accurate, but not independently verifiable. For stronger proof of when a file was signed, request a Trusted Timestamp instead. This requires signing in to a Majikah account (separate from your Majik Key signing account) and an internet connection. In the signing panel, enable Trusted Timestamp before clicking Sign. Majik Signature sends the request to an independent timestamp authority server, which returns an independently signed timestamp token using the same hybrid Ed25519 + ML-DSA-87 cryptography. Every Majikah account includes 5 free Trusted Timestamps every 24 hours, on a rolling window that replenishes from your first use rather than resetting at a fixed time each day. Additional TSA credit packs can be purchased if you need more. ![Majik Signature interface displaying the 5 daily free TSA credits counter alongside non-expiring credit package tiers from Starter to Enterprise](/articles/ms-tsa-pricing.webp) > **NOTE:** Local (self-reported) timestamps remain the default and continue to work fully offline. Trusted Timestamps are optional and only needed when independent proof of signing time matters — for example, legal or compliance use cases. > **NOTE:** Requesting a timestamp for the same content twice. This is a separate 24-hour window from the free daily credit allowance above — don't confuse the two. If you request a Trusted Timestamp for content whose digest was already timestamped within the last 24 hours, Majik Signature returns that same previously-issued token instead of generating a new one, and this does not consume an additional credit. Request a timestamp for that same digest again after that 24-hour window has passed, though, and it's treated as a new request — a credit is consumed, even if that exact digest was already timestamped once before. ### Batch Signing — Folders and ZIP Archives ![Screenshot of Majik Signature's Batch Signing feature showing multiple files queued for signing in a single operation.](/articles/ms-batch-file-signing.webp) Majik Signature supports batch signing of multiple files in a single workflow. In the Sign tab, click Browse Folder to select a folder and all its contents, or drag-and-drop an entire folder or a ZIP archive onto the input panel. Majik Signature automatically detects all files, recursively traverses nested folders and ZIPs, and signs each file individually with its own embedded signature. File previews are available before processing. After signing, you can seal files individually or all at once, then download the output as a repackaged ZIP that preserves your original directory structure. Each file carries its own signature — enabling granular per-file verification later. ### Setting Up Multi-Party Signing For documents that need more than one signer — contracts, approvals, or any collaborative workflow — Majik Signature supports multi-party signing. The first person to sign an unsigned file becomes its issuer. From the Sign tab, the issuer can add specific Expected Signers from Contacts to set a signing allowlist, restricting who else is allowed to sign the file — or leave signing open, so anyone with the file can sign. Share the file with each intended signer; each one signs independently, into their own Majik Key, without altering any prior signatures. Track pending and completed signatures from the document's progress view. Once every expected signer has signed, the issuer — and only the issuer — can seal the document to finalize it; if an allowlist is set, sealing isn't possible until everyone on it has actually signed. Verifiers can later inspect every individual signer's signature separately in Advanced verification mode. ### Sealing Cannot Be Undone > ⚠️ **WARNING:** Sealing permanently locks a file against any further signatures — including from you, even if you were the one who signed first. There is no way to "unseal" a file afterward. Only seal a document once you're certain everyone who needs to sign has already signed. ### Verifying a Signature 1. **1. Open the Verify Tab** *Navigate to the verification interface* - Go to the Verify tab (third tab in the navigation bar) - Choose Quick Mode for a fast drag-and-drop check, or Advanced Mode for detailed technical inspection, paginated signatures, and multi-signer detail 2. **2. Choose a Verification Mode** *Contact or self-reported keys* - In Advanced Mode, a Verify Against selector appears at the top of the page - The default option is Self-reported keys — this uses the public keys embedded in the signature envelope itself (trust-on-first-use mode) - Alternatively, select a specific contact from your contact directory if you know who signed it — this is the trusted verification path - For your first verification, stick with Self-reported keys 3. **3. Provide the Signed File** *Drop the file you want to verify* - Drag-and-drop the signed file onto the input panel, or click to browse — this also works for folders and ZIP archives signed via batch signing - The panel validates the file and checks for one or more embedded signatures - If a signature is found, a ✦ Signature detected chip appears along with metadata preview (signer ID, timestamp, content type, hash) - If no signature is found, a ◌ No signature found chip appears and verification is blocked 4. **4. Verify the Signature** *Run the cryptographic verification* - Click Verify in the bottom-right footer of the input panel - The output panel shows a real-time progress through 5 steps: ① Extract signature → ② Hash content → ③ Rebuild payload → ④ Ed25519 → ⑤ ML-DSA-87 - For multi-signature files, each signer is verified individually and listed separately in Advanced Mode - After a moment, the verification result appears in the output panel - A large verdict banner shows: Signature verified (green) if valid, Verification failed (red) if invalid, Content tampered (red) if the hash doesn't match, or Valid signature · unknown signer (amber) if the signature is cryptographically valid but the signer is not in your contact list - If a Trusted Timestamp is present, it's checked independently against the timestamp authority's signature and shown alongside the local timestamp 5. **5. Review the Result** *Inspect the verification details and final output* - The output panel shows algorithm-level checks: ✓ SHA-256 hash, ✓ Ed25519, ✓ ML-DSA-87, and whether the signer is a known contact - Below that is a metadata grid showing: signer fingerprint, verdict, timestamp (local and/or TSA), content type, and content hash - At the bottom is the embedded signature (base64) with a copy button - If the verdict is Valid or Unknown signer, the content is authentic and unmodified - If the verdict is Invalid or Tampered, the content has been altered or the signature is forged — do not trust it - This verification result is the final output of the workflow — no further steps are needed to establish authenticity ### Verifying Plain Text Signatures To verify a detached base64 signature against text, switch to Text mode in the Verify tab. Paste the original text in the first input box. Paste the base64 signature (from sig.serialize()) in the second input box. Optionally select a contact to verify against. Click Verify. The verification result appears in the output panel with the same detailed breakdown as file verification. > **NOTE:** Two verification modes: Contact verification (recommended) uses public keys from a known contact in your directory — this is the trusted path. Self-reported verification (TOFU — trust-on-first-use) uses the public keys embedded in the signature envelope itself. The signature is cryptographically valid, but you should cross-check the signerId fingerprint against a known source before trusting it. ### Managing Contacts (Optional) To verify signatures against known contacts, or to add them as Expected Signers on a multi-party file, you need to add them to your contact directory first. Go to the Identity tab and select the Contacts sub-tab. Click the plus (+) icon. Paste a contact's Invite Key (ask them to share it from their Accounts tab → hover over their account → click the link icon), or import a contact card PNG if they shared one that way. Click Add Contact. The contact now appears in your directory, in the Verify tab's contact selector, and in the Expected Signers picker when setting up a multi-party file. > **NOTE:** Don't forget to share your own invite key with others so they can verify your signatures or add you as an Expected Signer. Go to the Accounts tab, hover over your account, and click the link icon to copy your invite key. ### Feature Overview | Feature | Requires Internet? | Requires Account? | Requires Contacts? | | --- | --- | --- | --- | | Install Desktop App (Microsoft Store) | Yes (one-time) | No | No | | Create Majik Key Account | No | No | No | | Sign a File | No | Yes (unlocked) | No | | Sign Plain Text | No | Yes (unlocked) | No | | Add a Document Stamp (PDF/DOCX/XLSX) | No | Yes (unlocked) | No | | Add an Audio Stamp | No | Yes (unlocked) | No | | Add an Image Stamp / Batch Image Stamping | No | Yes (unlocked) | No | | Detached Signing (.mjksig) | No | Yes (unlocked) | No | | Expiring Signature | No | Yes (unlocked) | No | | Request a Trusted Timestamp (TSA) | Yes | Yes (Majikah account) | No | | Multi-Party Signing (Expected Signers / Allowlist) | No | Yes (unlocked) | Optional (for Expected Signers) | | Seal a Multi-Signature File | No | Yes (unlocked, issuer only) | No | | Batch Sign (Folder / ZIP) | No | Yes (unlocked) | No | | Verify a Signed File (self-reported) | No | No | No | | Verify a Signed File (against contact) | No | No | Yes (in directory) | | Verify a Folder / ZIP (batch) | No | No | No | | Verify Plain Text Signature | No | No | No | | Add Contacts to Directory | No | Yes | No | | Share Your Invite Key | No | Yes | No | *Caption: What you can do with Majik Signature, and what each feature requires* ### Back Up Your Seed Phrase Before Anything Else > ⚠️ **WARNING:** Your seed phrase is the master key to your signing identity. It is the ONLY way to recover your account on a new device or after a reset. Write it down on paper and store it in a safe place. Never store it digitally in plain text, never share it with anyone, and never enter it on any website other than Majik Signature. If you lose your seed phrase, your account and signing capability are permanently unrecoverable. ### What to Explore Next Once you're set up, Majik Signature has more to offer. Multi-Account Support lets you manage up to 100 local accounts — switch between them seamlessly for different signing contexts (personal, work, projects). Credential Store Passwordless Unlock (Windows Desktop App) lets you unlock with your face, fingerprint, or PIN instead of a typed passphrase, with the normal passphrase flow always available as a fallback. File Previews show inline previews of images, audio (with waveform player), video, PDFs, and text files before signing — including per-file popup previews in batch mode. Document, Audio, and Image Stamping let you add a professional visual or audible mark alongside your cryptographic signature. Detached Signing and Expiring Signatures give you finer control over how, and how long, a signature applies. Trusted Timestamps provide independently verifiable proof of signing time for legal or compliance needs. Multi-Signature Collaboration and sealing support contracts and approvals requiring more than one signer, and a sealed file can optionally be notarized afterward — anchoring its seal hash to a public blockchain for an independent, third-party-checkable timestamp. Hot Folders automatically verify — and sort into Verified/Failed — every file dropped into a monitored folder. CLI and MCP (Windows-only, experimental) let you script signing, verification, and timestamping, or connect an AI assistant to Majik Signature. Chrome Extension (planned) will let you sign and verify files directly from Chrome and detect signatures on any webpage. macOS and Linux desktop apps are also on the roadmap. If you find yourself unlocking your Majik Key often in one sitting, check Preferences for the option to switch from the default Unlock Per Operation to Unlock Once for the rest of your session. ### Security at a Glance Majik Signature uses hybrid Ed25519 + ML-DSA-87 (FIPS-204) cryptography. Ed25519 provides 128-bit classical security, while ML-DSA-87 provides NIST Category 5 post-quantum security. Both algorithms must verify for the signature to be valid — a break in one is not sufficient to forge. The SHA-256 content hash is part of the signed payload, ensuring any byte change invalidates both signatures. Private keys are encrypted at rest with Argon2id (64 MB memory-hard KDF) inside Majik Key, protected by your passphrase or, on Windows, optionally by Credential Store. Visual, audio, and image stamps are a presentation layer only — they are never part of what's cryptographically signed. All core cryptographic operations happen locally on your device — no server required, no internet needed. Your signatures created today will remain secure even when quantum computers become mainstream. > **NOTE:** For a deeper dive into any feature, check the dedicated documentation sections: Signing Files and Text, Document, Audio & Image Stamping, Trusted Timestamps, Multi-Signature Workflows, Verifying Signatures, Contacts, Supported File Formats, and How Majik Signature Works. For technical and cryptographic details, refer to the Majik Signature SDK documentation.