Overview

Kleidos on the M5StickS3

Kleidos turns the M5StickS3 into a password manager: it keeps your passwords encrypted on the board and types them into your computer over Bluetooth, after you unlock it on the board itself. The firmware costs nothing and asks for no account. There is nothing to install yet: version 0.1.0 is not released.

The same firmware runs on nine boards, and I recommend none of them over the others: this page is what the StickS3 does with it.

Updated

Kleidos on its own screen

Every recording here is of the StickS3's own screen, with a demonstration vault on a development build. The same recordings are on the recordings page, beside those of the other boards I have filmed.

Waking up and unlocking The StickS3 wakes on its locked screen. A button is held four times, the timing arc sweeping to a different digit on each hold; the device derives the key at the work factor a production build uses, and the unlocked vault lists its six demonstration services.
The settings tree The settings tree opened from the vault with one long press: the first five of its nine groups, the six rows of the interaction group, and the speed of the PIN dial stepped up, stepped back and saved.
A credential, opened On the StickS3 the vault list is walked down two rows and one entry opens on its card: the username, the masked password, and a live one-time code with its countdown. The action bar steps from typing to revealing, and the password stays visible for three seconds under a warning before the device masks it again on its own.
A one-time code The vault list flips to its 2FA page with one long press, and two demonstration codes stand there, each with the ring that shows how long it has left. They are real codes, computed on the device for the moment the clip was recorded.
Typing over Bluetooth A demonstration entry is open. The chooser asks what to type (the pair, the username, or the password), the device advertises and waits for a computer, and the cancelled session shuts Bluetooth down again.

Each picture's badge says how I made it, and the legend of the badges explains every kind.

  • Live from the device

What each control does

Each row quotes what the StickS3 itself shows for that control: on the pages it shows the first time it starts, or in the bar at the foot of its vault list.

The controls of the StickS3
Control What the board says it does
Button A, pressed (“big button below”) “NEXT”
Button A, held “OPEN”, “Hold A: PIN”
Button B, pressed (“small side button”) “PREV”
Button B, held “Hold B: back”, “PAGE”
The power button “Power: lock”

In the vault list a hold of B turns to the next page, because the list has nothing to go back to.

A hold is a press longer than 600 ms.

I will write a guide to every screen, board by board, once the interface stops changing.

What it holds, and how it keeps time

The vault is the same on every board. What changes with the board is how much it holds, how it keeps time for the one-time codes and where its backups go.

Chip
ESP32-S3
Input
Two buttons
Screen
135×240
Case
24×48 mm
Capacity
250 credentials, 40 two-factor codes
Clock
Internal, drifts through a sleep
Card slot
No: backups go through the panel

What it draws from its battery

What the StickS3 draws in each state, as the measurements page prints it, with what each state is and how each figure was taken.

What it costs

Kleidos costs nothing: there is nothing to buy from the project and no account to make, and the firmware is free software under GPL-3.0-or-later. What you pay for is the board.

Price
US$21.50
Listed by
M5Stack's own store
Product code
K150
Read on
1 November 2026

That is what the maker's own store asked on the day I read it, before shipping and taxes. Resellers ask their own, and the price moves.

Where the firmware stands

Kleidos is pre-release, at version 0.1.0: there is nothing to install yet, and the roadmap says what is left before the first release.

Version
0.1.0
To install
Nothing yet: no release is published
Hardened build
In development

I have not had the firmware or the cryptography reviewed by anybody outside the project; the security page says what you can and cannot check.