Kleidos
EN ES

A password manager you hold in your hand.

Your own credentials, encrypted on a small device, typed into your own computer over Bluetooth after you unlock it by hand. Four claims follow. Each one shows itself.

I am José M. Requena Plens. I build Kleidos on my own, and I say here what it cannot do yet.

See what Kleidos is →

It types. It does not send.

The device pairs as a Bluetooth keyboard and presses the keys for you, one report per character. Your computer receives keystrokes — the same bytes it gets from the keyboard on your desk — and never the password itself.

the device

one report per key

your computer

password

A password typed as fourteen keystrokes The device sends one keyboard report per character over Bluetooth. Fourteen reports leave the device and fourteen characters arrive in the password field of a login page. The password itself is never transmitted.

54445720444540603450454520 ms

The wait before each key, from one send. The firmware draws a fresh one between 20 and 60 ms every time, because a fixed interval would leave the rhythm of a send readable by anything watching the link.

A guess costs two seconds.

Your PIN is not stored anywhere. It is stretched into a key by PBKDF2-SHA256 — 175,000 iterations on the ESP32-S3 boards, 40,000 on the classic ESP32 ones — and the work is sized so that unlocking takes about two seconds. So does every wrong guess. Press the button and wait it out.

175,000 × PBKDF2-SHA256 2.0 s

ready no attempt yet

From the fourth wrong secret the device locks for 30 seconds, from the seventh for 5 minutes. The tenth erases the vault, every Bluetooth pairing and the admin network's identity.

There is no server.

Nothing in Kleidos talks to a machine you do not own. The vault is a few files on the device's own flash. What leaves it goes to your computer as keystrokes, to your browser over a Wi-Fi network the device itself puts up, or into a backup you export and keep. There is no account to create and nothing to sign in to.

Nine boards run the same firmware.

Four two-button sticks, an e-paper board driven by a dial, two touchscreens and two with a keyboard. What differs between them is a header file: the case, the screen, the buttons and the power chip. The vault, the cryptography and the Bluetooth keyboard are one source tree.

The nine boards, drawn to scale Nine board outlines at true relative scale, from each board's measured case, threaded by the one firmware they share: 24 by 48 millimeters for the smallest, 73 by 115 for the largest.
one source treeDrawn to scale from each board's measured case: 24 × 48 mm for the smallest, 73 × 115 mm for the largest.

The showcase has the recordings, the numbers behind every claim, and the list of what does not work yet.

See what Kleidos is →

Two more sections are on the way and are not published yet: DocumentationFlasher

Kleidos is not released yet: there is nothing to download.