# Kleidos

> Kleidos keeps your passwords encrypted on a small device and types them over Bluetooth, after you unlock it on the device itself. No app, no cloud. Coming soon.

This file is the index llmstxt.org describes, for agents and crawlers that
would otherwise have to guess what this site holds. The site is a welcome page
and a showcase, in each of two languages, and nothing else yet: the
documentation and the browser flasher have URLs reserved under this one and are
not published. A factual sentence reaches a page only when somebody can point
at the line of firmware that makes it true.

## Pages

- [Kleidos, in English](https://kleidos.dev/): the welcome page, and the way on
  to everything below it.
- [Kleidos, en español](https://kleidos.dev/es/): the same page in Spanish.
- [What Kleidos is, in English](https://kleidos.dev/showcase/): what the device is, how an
  unlock and a send work, how the firmware's own source is laid out, what the
  admin panel does, the nine boards it runs on, where the project stands, who
  does the work, and what it cannot do yet.
- [Qué es Kleidos, en español](https://kleidos.dev/es/showcase/): the same page, written
  in Spanish. Not a machine translation: both languages are written and
  reviewed together.
- [Kleidos in use, in English](https://kleidos.dev/showcase/in-use/): the recordings — one per
  board, a walk through the admin panel in a browser, and the section that
  says what kind of capture each badge on the site means.
- [Kleidos en uso, en español](https://kleidos.dev/es/showcase/in-use/): the same page in Spanish.
- [Sitemap](https://kleidos.dev/sitemap.xml): every URL above, each with its translation
  declared as an alternate.

## Feeds

- [Kleidos — news](https://kleidos.dev/rss.xml): RSS 2.0, in English. One item
  per milestone of the status tracker, published on the day its status was
  announced, each linking the row on the showcase it is about.
- [Kleidos — novedades](https://kleidos.dev/es/rss.xml): the same feed in
  Spanish. Each page advertises its own language's feed and no other.

## What Kleidos is

- A hardware password manager: the owner's own credentials, encrypted on a
  device they hold, typed into their own computer over Bluetooth LE HID after
  they unlock the device by hand. Same product category as a YubiKey or an
  OnlyKey.
- Firmware for the ESP32-S3 and the classic ESP32, built on ESP-IDF with no
  Arduino core, running on nine M5Stack and LilyGO boards from one source tree.
- Encryption at rest: AES-256-CBC with HMAC-SHA256, encrypt-then-MAC, keys
  derived with PBKDF2-SHA256.
- Bluetooth is output-only. The device sends keystrokes; it never reads what a
  host types.

## Where the project is

- The showcase carries a status tracker, "Where the project is": twelve
  milestones, each marked working, being built or not started, each naming the
  file in the repository that makes it true. Nothing there is dated, and a step
  nothing can show is listed as not started.
- Not started today: the power figures measured at the cell, the 50-cycle
  end-to-end run, the first release, flashing from a browser, and a review by
  anybody outside the project.
- Being built: the admin panel and the hardened build.

## Where the pictures come from

- Every clip and screen on the site came out of the thing it shows, and each
  figure is badged with which kind it is: "How I made these recordings", on the
  in-use page, says how.
- Three kinds are the device itself — a live frame-by-frame stream over Wi-Fi
  while a script works the controls, a clip assembled from the device's own
  captures, and a single capture of its screen. Two are not, and say so: the
  admin panel's own page in a browser over demo data, and the hero strip, which
  is a drawing of each board carrying a capture of its screen.
- Every vault shown is a demonstration vault on a development build. Each
  published file has a row recording its hash and the file it came from.
- The recordings are a page of their own because they are what grows: the plan
  is every flow filmed on each of the nine boards. https://kleidos.dev/showcase/ carries the
  argument and https://kleidos.dev/showcase/in-use/ carries the demonstration.

## What this site does not have

- No download, no installer and no version to fetch. There is no public
  release: the page says so in its own words — "Pre-release, version 0.1.0. I have not had it audited by anybody independent."
- No account, no sign-up and no price.
- No analytics and no cookies: "No analytics, no cookies, and nothing on this page is loaded from another site."
- No source repository link: it is private while the first release is prepared.
  The page says so where it offers the feed and the author's two accounts.
- No claim this project has been audited, and no figure for how long a PIN
  would take to guess. What the firmware cannot do yet is a section of its own
  on the showcase, "What it does not do yet".

## Reuse

- Firmware and page: GPL-3.0-or-later, https://www.gnu.org/licenses/gpl-3.0-standalone.html
- Author: José Manuel Requena Plens, https://jmrp.io/
- The device marks shown on the page are drawn from each board's measured case;
  the service logos in the demo vault are public-domain artwork, credited on
  the page itself.