Kleidos keeps your passwords encrypted on a small device and types them for you over Bluetooth, after you unlock it on the device itself. No app. No cloud. Nothing to sign up for.
Enter your PIN on the device. The two-button models have no keypad: you hold a button while an arc sweeps through the digits and let go on yours, once per digit. A PIN is 4, 6 or 8 digits; the models with a keyboard take a passphrase instead, and the touch models let you choose one.
Scroll your vault and open an entry. It draws the service's mark when it recognizes the name, and the password stays masked until you ask for it, then masks itself again.
Choose what to send. Kleidos becomes a Bluetooth keyboard, types it into the computer you paired, and shuts Bluetooth down again.
To add, import or export entries, open the admin panel: the unlocked device puts up its own Wi-Fi network and shows a QR code. Scan it, and the panel is in your browser. The models with a keyboard can also edit entries on the device.
The vault is a few files on the device's own flash. Everything below is about what those files are worth to someone who takes them.
A record is encrypted with AES-256-CBC and authenticated with HMAC-SHA256, encrypt-then-MAC. The tag is verified before anything is decrypted, and it covers the record's type, its slot and a counter — so a record cannot be moved to another slot, read as another type, or rolled back on its own. Password entries are all padded to the same 4 KB, so their size says nothing about what they hold.
The key is derived from your PIN with PBKDF2-SHA256 over a random per-vault salt: 175,000 iterations on the ESP32-S3 boards, 40,000 on the classic ESP32 boards, each sized to roughly a two-second unlock. What the device stores is a verifier, not the PIN. Encryption, authentication and the unlock check use three separate keys.
From the fourth wrong secret the device locks for 30 seconds, from the seventh for 5 minutes. The tenth erases the vault, every Bluetooth pairing and the admin network's identity. The attempt is written down before the secret is checked, so cutting the power does not buy a guess back.
Locking and sleeping both stop the radios and then erase the keys and the decrypted lists from memory. The buffers that held them are overwritten on purpose, not just released.
The release and hardened builds compile no serial console and no log calls at all, and a crash prints nothing — no banner, no registers, no backtrace. The chip's own mask-ROM boot line is all that remains, and it says nothing about your vault. Passwords, usernames and PINs are kept out of logs by design.
In development
On the 8 MB boards the hardened build adds Secure Boot v2, flash encryption and encrypted settings, and ties the vault key to the individual chip — so a copy of the flash cannot be attacked away from the device. I have not finished it: I have still to write what provisions the chip key on the ESP32-S3 boards, so a hardened build cannot create a vault there today.
In development
Everything in bulk — adding entries, importing from another manager, exporting an encrypted backup, updating the firmware — happens in a browser, on a network the device itself puts up. The device is the web server: nothing goes through an outside service.
The panel is in development. It is already where entries are added, imported from another manager and exported as an encrypted backup, and it is still changing: where the device draws each service's mark, the panel prints the name as text.
I opened the panel's own page — the bytes the firmware serves — in a browser against a demo vault served from this computer instead of from a board, and captured it there. The walkthrough and the rest of the captures are with the other recordings.
One firmware across nine boards, from a 24 × 48 mm stick with two buttons to a 73 × 115 mm unit with a keyboard. Which board you use changes how you unlock it and how much the screen can show; it does not change the vault.
Each board is drawn from its own measured case and screen dimensions, not from a photograph. Pictures and recordings of the real screens are on the in-use page.
Screens are shown in English. The device itself also speaks Spanish, French, German and Italian.
Kleidos is an independent project, not affiliated with M5Stack or LilyGO. Product names are their owners' trademarks.
The whole of it, honestly: what works, what is being built, and what has not been started. Each row names what makes it true.
Working
Every board registers its own hardware — its screen, its power controller, its buttons or keyboard — into the same firmware, and the drawings in “The devices” are generated from the same measured boards (src/boards/).
Working
Entries are stored as encrypted, authenticated records, with separate keys for encryption, authentication and the unlock check, and the host test suite covers the round trip and the refusals (src/vault/).
Working
The two-button boards dial a PIN on the timing arc, the boards with a keyboard take a passphrase, and the touch boards are offered either (src/ui/entry/).
Working
The device becomes a Bluetooth keyboard for the session it is told to start, types over a bonded and authenticated link, and shuts the radio down again when the session ends (src/ble/).
Working
On the boards with room for two app partitions, firmware is uploaded from the admin panel; an image built for another board or an older version is refused, and an update that boots but never confirms itself rolls back on its own (src/platform/ota.cpp).
Being built
In development. It is already where entries are added, imported from another manager and exported as an encrypted backup, and it is still changing (src/web/).
Being built
In development. Secure Boot, flash encryption and encrypted settings are configured for the 8 MB boards; I have not written what provisions the per-chip key on the ESP32-S3 ones yet, so a hardened build cannot create a vault there today (docs/security/secure-provisioning-checklist.md).
Not started
Every board's current is still an estimate. I have not made the bench measurements that would replace the estimates with readings from a meter, so this page quotes no power figure at all (docs/testing/production-sleep-checklist.md).
Not started
The release criteria ask for 50 end-to-end cycles — boot, unlock, browse, type, sleep — with no crash. I have not run them, and I have ticked no other box on that list either (docs/QA_CHECKLIST.md).
Not started
There is nothing to install yet: the firmware is at version 0.1.0, no release is published, and this page says “coming soon” because that is what it is (version.txt).
Not started
The page that would install the firmware over USB from a browser is written and parked: it has no release to offer, so this site publishes nothing at its address and its own manifest lists no build (web/).
Not started
I have not had the firmware or the cryptography reviewed by anybody outside the project. The dossier an auditor would start from is written and waiting (docs/security/audit-dossier.md).
I put no dates on this list. It names only work that exists in the repository, and a step nothing there can show is listed as not started.
Read this part before the rest.
The project is organized the way a company is. Every department below is work that exists in this repository, and every post is held by the same person.
Founder and director
José M. Requena Plens
Creative director
José M. Requena Plens
Yes, him again.
docs/design/
Head of board selection
José M. Requena Plens
Still him.
variants/
Principal firmware engineer
José M. Requena Plens
src/
Cryptography architect
José M. Requena Plens
The hiring process was short.
src/crypto/
Head of product design
José M. Requena Plens
src/ui/
Server engineer
José M. Requena Plens
Internal promotion.
src/web/
Client engineer
José M. Requena Plens
web_src/index.html
Head of quality
José M. Requena Plens
There is a career path here, too.
test/
Board test technician
José M. Requena Plens
qa/tests/hardware/
Technical writer
José M. Requena Plens
And the coffee.
docs/
Version manager
José M. Requena Plens
version.txt
Legal counsel (GPL-3.0)
José M. Requena Plens
Open positions: all of them.
LICENSE
There is nothing to install and nothing to sign up for. Pick whichever of these you already read.
There is no repository to watch yet: I am keeping the source private while I prepare the first release, so the feed and the two accounts are the whole of it.
