~120 passwords per person, typed dozens of times a day.
Every login already carries dwell (how long a key is held) and flight (the gap to the next key). CypherKey reads timing that is being produced anyway.
Private beta · Zero-knowledge · Open source
Your password always works when you type it.
A zero-knowledge password manager with a second factor you already carry: the rhythm of your hands. No phone, no code, no dongle.
01 / 05 · Why rhythm
39% of breaches start with a stolen credential.
A leaked password works from anywhere, for anyone. The dark-web email says the secret is out. Nothing in a password alone can tell who is typing it.
A second factor you cannot leave at home.
Rhythm is a behavioral biometric you carry in your hands. No phone to grab, no code to copy, no key to lose or charge. It works with the passwords you already have.
Zero-knowledge vault. Visible light whenever it listens.
The server holds only ciphertext and an Argon2id hash. Raw keystrokes are destroyed after each sample; only means and floored variances remain. Open source, self-host in one command.
Teach it your rhythm. Then hand over the keyboard.
Eight samples, one intruder, one verdict. Runs entirely in the browser with zero network requests. Best on a physical keyboard.
Origin · 2007 → 2026
Shawn J. Stewart · Irietek Corporation ·
More about Shawn → ·
How it works →
First written in 2007 to tell a human from a bot. It told people apart instead.
Shawn J. Stewart built Keystroke Captcha as a telemetry script inside a custom MVC framework, listening to key events to decide whether a form was being filled in by a person. It measured dwell and flight — and the timings did not just separate humans from machines, they separated one person from another. He pointed it at passwords at CBSSports.com in 2010: teammates could not log in with his credentials, and he could, first try.
Shawn J. Stewart · Irietek Corporation ·
More about Shawn → ·
How it works →