KeePass can't protect you from a stealer. So I built something that can.

I built a hardware password manager because KeePass doesn't actually protect you

I'm a hobbyist developer. I work with sensitive data every day — accounts, crypto wallets, corporate systems, personal communications.

One day I had an uncomfortable realization.

The problem nobody talks about

I was using KeePassXC. Strong master password, encrypted database, local-only. I thought I was doing everything right.

Then I thought about what actually happens when I unlock my vault:

The encrypted database sits on disk — readable by any process with file access
The decrypted copy lives in RAM — readable by any process with memory access
The master password gets typed on a keyboard — interceptable by any keylogger
All of this happens inside an OS shared with dozens of other running programs

KeePass protects you from someone stealing your hard drive. It does not protect you from malware already running on your machine.

A stealer with a keylogger gets your master password when you type it, then grabs the database file. Game over. And you'll never know it happened.

The same is true for Bitwarden, 1Password, and every other software password manager. They're all prisoners of the OS they run on.

Cloud managers add another layer: you're now trusting a third-party server and its breach history.

Hardware keys like YubiKey solve part of the problem (2FA), but they don't replace a full offline password manager. They still require the target system to support their protocol.

I wanted something different.

What I actually wanted

A device that:

Stores passwords completely offline, on hardware
Never transfers the database to the computer — not even in encrypted form
Simply types the password like a keyboard (USB HID)
Works on any OS without installing software
Has no moving parts, no battery, no cloud

So I built it.

Introducing Protokey

Protokey is a compact USB device built on a microcontroller that acts as a "smart keyboard with memory."

You browse your vault on a 3.5" touchscreen → select an account → tap autofill → Protokey types your login, password, and Enter into whatever fi m,eld is focused. The computer sees only keystrokes. The database never leaves the device.

How it works technically

Hardware:

Panlee SC01 — 3.5" capacitive touchscreen (320×480), SD card slot, ESP32 microcontroller
Arduino with ATmega32u4 — handles USB HID pairing with the host computer
No physical buttons, no battery, no external power required

![Inside the device]d(https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d87jmgqxiikbntoyw92s.jpg)

Firmware & encryption:

Firmware, flash memory, bootloader, and user data are all encrypted
Master password stays in your head; derived key unlocks your data on the flash
Encryption keys for the firmware ship in the box with your device — they belong to you from day one
You can take full custody of your keys. If you want us to hold a copy for recovery, that's opt-in. If you want us to delete our copy, we will.

Unlike most hardware security products, we can't update your device without your explicit involvement. That's a feature, not a limitation.

The vault

Each record supports up to 16 fields. Field types:

Type	Purpose
text / word	plain text
login / email / phone	aggregation (fast search)
secret	hidden field with generator
TOTP	2FA time-based codes
tags	comma-separated, filterable
autofill template	`{field_name}`, `{tab}`, `{enter}`

The autofill template is the key feature. You define exactly what gets typed and in what order. Works for single-field logins, multi-step forms, desktop apps, terminal prompts — anything that accepts keyboard input.

Search and filtering happen in real time across visible fields, tags, and aggregation fields. Deep search (across all hidden fields) takes up to 3 minutes on 10,000 records — worth it when you need it.

Web interface

WiFi is used exclusively for device administration — never for password transmission.

Connect Protokey to your local network → access the web panel (HTTPS) to:

Create and edit records
Import/export backups
Update firmware
Manage TOTP entries

The WiFi credential setup and web panel access are done from the device's settings menu.

Physical threat protection

This one I'm quietly proud of.

Protokey has a duress system built into the PIN settings:

Second PIN — differs from your real PIN by one character. When entered, it switches the device into "panic mode": only shows records tagged with a specific decoy tag, sets the second PIN as the new primary, and wipes all duress settings — so there's no evidence a second PIN ever existed.
Blank password entry — by default, the device accepts any input at the unlock screen. You can require a specific master password, or leave it open and rely on PIN only.
Wipe after N attempts — standard brute-force protection.

The result: if someone demands access to your device, you hand them a plausible decoy vault. Your real records are in a hidden layer. The device shows no signs of having one.

Restoring from that state requires a backup. Keep one.