Kleidos
EN ES
Menu

A password manager you hold in your hand.

Your own passwords, encrypted on a small device you carry, and typed into your computer over Bluetooth only after you have unlocked it on the device itself.

I am José M. Requena Plens. I build Kleidos on my own, and I say here what it cannot do yet.

Status
In development. Not released: there is nothing to download yet.
Boards
Nine, on the ESP32-S3 and the classic ESP32
Capacity
90 to 500 credentials and 30 to 50 two-factor (TOTP) codes, depending on the board
Vault
AES-256-CBC + HMAC-SHA256, its key derived from your PIN by PBKDF2-SHA256
Link
A Bluetooth LE keyboard: it sends keystrokes and reads nothing
Server
None, and no account
The nine boards, drawn to scale. Nine boards at true relative scale, each drawn in graphite from its measured case with a capture of its own screen in the glass. The shorter ones stand two to a column so the row is as tall as the tallest board: 24 by 48 millimeters for the smallest, 73 by 115 for the largest.
Nine boards run the same firmware. Four two-button sticks, an e-paper board driven by a wheel, two touchscreens and two with a keyboard. What differs between them is a header file: the case, the screen, the buttons and the power chip. The vault, the cryptography and the Bluetooth keyboard are one source tree. Drawing with device screens Drawn to one scale from each board's measured case, in graphite, with each board's own screen in the glass; the shorter boards stand two to a column. 24 × 48 mm for the smallest, 73 × 115 mm for the largest.

See what Kleidos is →

It types. It does not send.

The device pairs as a Bluetooth keyboard and presses the keys for you, one report per character. Your computer receives keystrokes, the same bytes it gets from the keyboard on your desk, and never the password itself.

the device

one report per key

your computer

password

The device sends one keyboard report per character over Bluetooth. Fourteen reports leave the device and fourteen characters arrive in the password field of a login page. The password itself is never transmitted.

54 , 44 , 57 , 20 , 44 , 45 , 40 , 60 , 34 , 50 , 45 , 45 , 20 ms

The thirteen waits between fourteen keys, from one send. The firmware draws a fresh one between 20 and 60 ms every time, because a fixed interval would leave the rhythm of a send readable by anything watching the link.

The radios are off.

Unlocked and sitting in the vault, the device has no radio on. Bluetooth comes up to send a password, paired only by LE Secure Connections with a six-digit number you confirm on its screen, and goes down when the send ends. Wi-Fi is up only while the admin panel is open, or for the few seconds it takes to set the clock when you ask it to. For the panel it is a WPA3 network of the device's own for one client, with a password drawn at random unless you choose to keep one. The two are never up at once: the panel is reached only after Bluetooth has been stopped.

Which radio is on at each moment of one session
Moment Bluetooth Wi-Fi
Asleep off off
Unlocking with the PIN off off
In the vault off off
Sending a password Until the last key is sent, then down on off
Back in the vault off off
Admin panel open Its own WPA3 network, one client, a new password off on
Locked again off off
Every Bluetooth session has one owner that stops it, and a test in the repository pins which surface owns each and where it ends. Locking or going to sleep turns both radios off, and then overwrites the keys and the decrypted lists in memory.

You bring the passwords you already have.

Export your vault from the manager you use now and open the device's admin panel. The page the device serves reads the file in your browser and shows you every login it found before anything moves; cards, identities, documents, secure notes and passkeys are counted by category and left out, because none of them has a password to type. Nothing reaches the device until you approve that preview. The other way around, the panel exports an encrypted backup you keep.

your export

  • 1Password .1pux · CSV
  • Bitwarden JSON · CSV
  • Chrome CSV
  • Firefox CSV
  • KeePass CSV
  • LastPass CSV
  • Proton Pass CSV

A preview in your browser

Read by the panel's page. Nothing has left yet.

only what you approve

the device's vault

There is no server.

Nothing in Kleidos talks to a machine you do not own. The vault is a few files on the device's own flash. What leaves it goes to your computer as keystrokes, to your browser over a Wi-Fi network the device itself puts up, or into a backup you export and keep. Every entry occupies the same four kilobytes of that flash, so even the size of a file tells somebody who takes it nothing about what is in it. There is no account to create and nothing to sign in to.

Where each thing is taken to its end.

Every section below holds one kind of evidence, and goes as far as the evidence does.

  1. Overview → The case for the device, and recordings of it at work.
  2. Recordings → Recordings from one board of each kind, and how each picture on the site was made.
  3. Roadmap → What works, what is being built, and what is still only a plan.
  4. Security → What attacks it, and what stops each attack.
  5. Measurements → What the boards I have measured draw, how long a charge lasts where I can estimate it, and where they miss their budget.
  6. Architecture → How the firmware is put together, one module at a time.
  7. Documentation not published yet
  8. Flasher not published yet

The nine boards this runs on are development hardware I bought myself. If you want to help pay for the next one, the overview has the two places. A donation buys you nothing at all, which is the point.