Your Passwords.
Your Hardware.
Your Control.
A military-grade hardware password manager built on ESP32-S3. ECDH P-256 + AES-256-GCM end-to-end encryption. Zero cloud. Zero trust. Zero compromise.
Built for the paranoid
Every feature designed with adversarial assumptions. No cloud. No trust. Every byte stays on hardware you control.
AES-256-GCM Encryption
Every data frame encrypted with AES-256-GCM using an ECDH-derived session key. Fresh random nonce per message — authenticated encryption prevents tampering.
ECDH P-256 Key Exchange
Ephemeral P-256 keypairs per session. Session key via HKDF-SHA256 with 6-digit code as PSK — MITM cannot derive the key without physical access.
Pattern Unlock
Morse-like short/long press patterns on the joystick — second unlock factor running in parallel with PIN. Configurable up to 12 elements.
Duress Mode
Decoy vault under a separate duress PIN — indistinguishable from the real vault. Protects under coercion without revealing real credentials.
TOTP Generation
Time-based one-time passwords on-device using the DS3231 RTC. No phone needed for 2FA — the vault itself is your authenticator.
Hardware Security Module
ESP32-S3 hardware-accelerated P-256 via mbedtls. Keygen + ECDH in ~50ms. MPU6050 tamper detection. AT24C32 EEPROM for secure storage.
Memory Zeroing
All session keys, ECDH private keys, and codes zeroed with secureZero() (volatile-pointer memset) on timeout, lock, or exit.
Atomic SD Writes
4-step safe write: backup → write .tmp → verify integrity → atomic commit. Boot-time recovery from .bak. No data loss on power cut.
Security you can see
Every step is designed so that even if an attacker intercepts the wire, they learn nothing.
Power On & Unlock
Boot the device. Enter your PIN or use pattern unlock (Morse-like short/long presses). Duress PIN opens a decoy vault.
Choose Access Mode
BLE Mode for credential typing, Dashboard Mode for USB management, or AP Mode for WiFi hotspot access from your phone.
6-Digit Code Displayed
The ESP32 generates a cryptographically random 6-digit code. It appears on the TFT — you type it into the companion app. It never crosses the wire.
ECDH P-256 Handshake
Both sides exchange ephemeral P-256 public keys. Session key derived via HKDF-SHA256 with the 6-digit code as PSK. MITM-proof by design.
AES-256-GCM Session
Every message after handshake is encrypted with AES-256-GCM. Fresh nonce per frame. Auth tag prevents tampering. Your vault data flows securely.
Auto-Lock & Zeroing
60s inactivity auto-lock. All session keys, ECDH keys, and codes zeroed with secureZero() — volatile memset that cannot be optimized away.
Watch your data get protected
Three paths. One vault.
BLE for typing. USB for management. WiFi for convenience. All encrypted. All isolated. All zeroed on exit.
BLE Mode
Bluetooth Low EnergyBLE HID keyboard — types credentials directly into your computer or phone like a real keyboard. Zero app install needed for typing.
Dashboard Mode
USB SerialUSB-CDC serial + ECDH handshake. Full vault management over a single USB cable with AES-256-GCM on every frame.
AP Mode
WiFi HotspotSelf-contained WiFi hotspot. Manage your vault from your phone browser — captive portal, WPA2 + ECDH + AES all active.
ESP32-S3Purpose-built for security
Every peripheral chosen for a reason. DS3231 for TOTP. MPU6050 for tamper detection. Nothing is decorative.
4-Layer
Security Stack
Dashboard Mode is unreachable without an authenticated ECDH session. There is no unauthenticated endpoint. Every layer exists because the layer below is insufficient alone.
Physical Handshake
ESP32 generates a random 6-digit code displayed on TFT. User types it into the companion app. The code never crosses the wire — mixed into KDF as PSK.
ECDH P-256 Key Exchange
Ephemeral keypairs exchanged. Session key = HKDF-SHA256(ecdh_secret ∥ SHA-256(code)). Even MITM intercepting both pubkeys cannot derive the key.
AES-256-GCM Wire Encryption
Every post-handshake message: [version][msg_type][payload_len][12B nonce][ciphertext][16B auth tag]. Fresh nonce per message. Authenticated encryption.
Memory Zeroing & Isolation
Session key, ECDH private key, code live ONLY in module-static buffers. Zeroed with secureZero() on timeout, lock, exit, or disconnect.
Obfuscation layers
AP Mode adds four obfuscation layers on top of the 4-layer security stack. Even the WiFi traffic shape reveals nothing.
URL Obfuscation
API paths tunneled through non-obvious URL patterns to resist fingerprinting and automated probing.
Header Obfuscation
HTTP headers randomized and padded to defeat traffic analysis and protocol fingerprinting.
Method Tunneling
HTTP methods tunneled through uniform interface — no REST verb leaks revealing API structure.
Traffic Obfuscation
Timing and size normalization make encrypted traffic indistinguishable from random noise.
Take control of your credentials
Build your own SecureVault. Flash the firmware. Own your security. No subscriptions. No cloud. No trust required.