# Kleidos

> Kleidos keeps your passwords encrypted on a small device and types them over Bluetooth, after you unlock it on the device itself. No app, no cloud. Coming soon.

This file is the index llmstxt.org describes, for agents and crawlers that
would otherwise have to guess what this site holds. The site is a showcase:
two pages in each of two languages, and nothing else. A factual sentence
reaches them only when somebody can point at the line of firmware that makes
it true.

## Pages

- [Kleidos, in English](https://docs.jmrp.io/kleidos/): what the device is, how an unlock and a
  send work, how the firmware's own source is laid out, what the admin panel
  does, the nine boards it runs on, where the project stands, who does the
  work, and what it cannot do yet.
- [Kleidos, en español](https://docs.jmrp.io/kleidos/es/): the same page, written in Spanish.
  Not a machine translation: both languages are written and reviewed together.
- [Kleidos in use, in English](https://docs.jmrp.io/kleidos/in-use/): the recordings — one per
  board, a walk through the admin panel in a browser, and the section that
  says what kind of capture each badge on the site means.
- [Kleidos en uso, en español](https://docs.jmrp.io/kleidos/es/en-uso/): the same page in Spanish.
- [Sitemap](https://docs.jmrp.io/kleidos/sitemap.xml): the four URLs above, each with its
  translation declared as an alternate.

## Feeds

- [Kleidos — news](https://docs.jmrp.io/kleidos/rss.xml): RSS 2.0, in English. One item per
  milestone of the status tracker, published on the day its status was
  announced, each linking the row on the page it is about.
- [Kleidos — novedades](https://docs.jmrp.io/kleidos/es/rss.xml): the same feed in
  Spanish. Each page advertises its own language's feed and no other.

## What Kleidos is

- A hardware password manager: the owner's own credentials, encrypted on a
  device they hold, typed into their own computer over Bluetooth LE HID after
  they unlock the device by hand. Same product category as a YubiKey or an
  OnlyKey.
- Firmware for the ESP32-S3 and the classic ESP32, built on ESP-IDF with no
  Arduino core, running on nine M5Stack and LilyGO boards from one source tree.
- Encryption at rest: AES-256-CBC with HMAC-SHA256, encrypt-then-MAC, keys
  derived with PBKDF2-SHA256.
- Bluetooth is output-only. The device sends keystrokes; it never reads what a
  host types.

## Where the project is

- The page carries a status tracker, "Where the project is": twelve milestones,
  each marked working, being built or not started, each naming the file in the
  repository that makes it true. Nothing there is dated, and a step nothing can
  show is listed as not started.
- Not started today: the power figures measured at the cell, the 50-cycle
  end-to-end run, the first release, flashing from a browser, and a review by
  anybody outside the project.
- Being built: the admin panel and the hardened build.

## Where the pictures come from

- Every clip and screen on the site came out of the thing it shows, and each
  figure is badged with which kind it is: "How these recordings were made", on the
  in-use page, says how.
- Three kinds are the device itself — a live frame-by-frame stream over Wi-Fi
  while a script works the controls, a clip assembled from the device's own
  captures, and a single capture of its screen. Two are not, and say so: the
  admin panel's own page in a browser over demo data, and the hero strip, which
  is a drawing of each board carrying a capture of its screen.
- Every vault shown is a demonstration vault on a development build. Each
  published file has a row recording its hash and the file it came from.
- The recordings are a page of their own because they are what grows: the plan
  is every flow filmed on each of the nine boards. The front page carries the
  argument and https://docs.jmrp.io/kleidos/in-use/ carries the demonstration.

## What this site does not have

- No download, no installer and no version to fetch. There is no public
  release: the page says so in its own words — "Pre-release, version 0.1.0. Nobody independent has audited it."
- No account, no sign-up and no price.
- No analytics and no cookies: "No analytics, no cookies, and nothing on this page is loaded from another site."
- No source repository link: it is private while the first release is prepared.
  The page says so where it offers the feed and the author's two accounts.
- No claim this project has been audited, and no figure for how long a PIN
  would take to guess. What the firmware cannot do yet is a section of its own
  on the page, "What it does not do yet".

## Reuse

- Firmware and page: GPL-3.0-or-later, https://www.gnu.org/licenses/gpl-3.0-standalone.html
- Author: José Manuel Requena Plens, https://jmrp.io/
- The device marks shown on the page are drawn from each board's measured case;
  the service logos in the demo vault are public-domain artwork, credited on
  the page itself.