---
title: "SafeID Desktop"
description: "SafeID Desktop: Windows and macOS application that lets the applications on the computer sign with SafeID cloud certificates, through the system certificate store or a PKCS#11 module."
canonical: "https://docs.lacunasoftware.com/en-us/articles/safeid-desktop"
locale: "en"
product: "SafeID Desktop"
last_updated: "2026-10-14"
---

# SafeID Desktop

SafeID Desktop makes SafeID cloud certificates available to the applications on the user's
computer. The private keys never leave the SafeID cloud HSM: when an application signs with one
of these certificates, SafeID Desktop asks for the authorization on the SafeID mobile app and
returns the signature computed in the cloud.

- [Changelog](https://docs.lacunasoftware.com/en-us/articles/safeid-desktop/changelog)

## Requirements

- **Windows** 10 or later, x64 or ARM64, with **SafeID Desktop Provider** installed (see below).
- **macOS** 10.15 or later, Intel or Apple Silicon.
- The **SafeID mobile app**, to authorize signatures.

## Download

| Version | Production | Homologation |
|---|---|---|
| 1.4.5 | [safeid-desktop-PRD_1.4.5.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-PRD_1.4.5.zip) | [safeid-desktop-HOMOLOG_1.4.5.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-HOMOLOG_1.4.5.zip) |
| 1.4.4 | [safeid-desktop-PRD_1.4.4.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-PRD_1.4.4.zip) | [safeid-desktop-HOMOLOG_1.4.4.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-HOMOLOG_1.4.4.zip) |
| 1.4.3 | [safeid-desktop-PRD_1.4.3.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-PRD_1.4.3.zip) | [safeid-desktop-HOMOLOG_1.4.3.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-HOMOLOG_1.4.3.zip) |
| 1.4.2 | [safeid-desktop-PRD_1.4.2.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-PRD_1.4.2.zip) | [safeid-desktop-HOMOLOG_1.4.2.zip](https://cdn.lacunasoftware.com/temp/safeweb/safeid-desktop-HOMOLOG_1.4.2.zip) |

Use the production package with the SafeID production environment, and the homologation package
only to test against the SafeID homologation environment. The changes of each version are in the
[changelog](https://docs.lacunasoftware.com/en-us/articles/safeid-desktop/changelog).

## Installation

**Windows.** Run the SafeID Desktop installer. On first launch, the app checks whether SafeID
Desktop Provider is installed and, if not, downloads its installer for the system architecture.
SafeID Desktop Provider installs the components that the other applications load — the Key
Storage Provider and the PKCS#11 module — into the Windows system folders, so it requires
administrator rights.

**macOS.** Open the DMG and drag SafeID Desktop to the Applications folder. If the app is started
from the DMG, it moves itself to the Applications folder.

Both versions update automatically. On Windows, the app also checks the SafeID Desktop Provider
version on startup and asks for its update when needed.

## Using the certificates

After signing in, the user chooses which SafeID certificates to install. SafeID Desktop must be
running to sign; when an application requests a signature and the app is not running, it is
started automatically.

### Applications that use the system certificate store

Most applications — browsers, document signers, applications built on Windows CNG or on the macOS
keychain — need no configuration: the installed certificates show up in the system certificate
store like any other certificate.

- **Windows**: through the SafeID Key Storage Provider (CNG KSP).
- **macOS**: through a CryptoTokenKit extension, which exposes the certificates in the keychain.

### Applications that use PKCS#11

Applications that load a PKCS#11 module instead of using the system store, such as Firefox and
Java (SunPKCS11), must be pointed at the SafeID PKCS#11 module by its full path:

| System | Module path |
|---|---|
| Windows | `C:\Windows\System32\safeid-p11.dll` |
| macOS | `/Applications/SafeID Desktop.app/Contents/Resources/libsafeid-p11.dylib` |

On Windows, the module is installed for both 64-bit and 32-bit applications, so the bare name
`safeid-p11.dll` also works.

**Firefox**: open **Settings → Privacy & Security → Security Devices → Load**, and enter the module
path.

**Java**: create a SunPKCS11 configuration file that points to the module, for example:

```text
name = SafeID
library = C:/Windows/System32/safeid-p11.dll
```

The module is read-only and scoped to signing: it lists the installed certificates and their keys
and signs with RSA (`CKM_RSA_PKCS`). It asks for no PIN, since each signature is authorized on the
SafeID mobile app.