Sigstore provides free tools for signing and verifying software. It supports keyless signing through OpenID Connect, so developers do not have to manage long-lived signing keys. The listing says npm and major package registries use it. Maintainers use Sigstore to show that a release came from a trusted source. The project is available at sigstore.dev.
How Sigstore compares with its closest alternatives
All 5 closest alternatives have a free plan, as Sigstore does. All 5 offer an API, as Sigstore does. Sigstore offers a desktop app. Of the alternatives, 2 offer a desktop app. Sigstore was founded in 2021; the alternatives were founded between 2009 and 2021, 3 of them earlier. Sigstore has no single headquarters on record; its alternatives with a known headquarters are in the United States.
Market position · Security
How Sigstore compares in Security
Sigstore has high opportunity and sits in the middle third of 361 live Security tools on FalcoScan. Across Security, the average opportunity score is 70.4 and the average saturation score 33. FalcoScan rates Sigstore's own market position as open. 121 of the 361 operating Security tools have hot momentum, and FalcoScan has recorded 1 shutdown in the category.
The closest alternatives to Sigstore that are still running, matched on the AI capabilities, uses and audience they share, are Chainguard, Cloudflare Security, Tekton, Socket Security, and HashiCorp Vault.
Is Sigstore still running?
Yes. As of 2 November 2026, FalcoScan lists Sigstore as operating at sigstore.dev.
Where is Sigstore based?
Sigstore has no single headquarters: FalcoScan's records list it as a distributed, remote-first company.
Does Sigstore have an API?
Yes. Sigstore offers an API.
Who is Sigstore for?
Sigstore is built for developers and security teams.
How do I sign in to Sigstore?
Sign in on Sigstore's own website, sigstore.dev. FalcoScan reviews Sigstore but does not run its accounts, so logins, passwords and billing are handled by Sigstore directly.