MIT
Everything that touches your keys. Read it, fork it, ship it inside something else.
Private beta · 25 seats · M2 · Dec 2026
Be one of the first to unlock a vault with your hands.
Chrome extension, hosted sync, Recovery Kit and the Rhythm Light. Fourteen days of daily use; we ask for a median unlock under 4 s and an amber rate under 10%.
If you type with dictation or an on-screen keyboard, say so — the rhythm factor is not for you yet, and a seat should not be spent finding that out.
Roadmap
Every milestone has an exit criterion you can verify in ten minutes.
Dates assume roughly fifteen hours a week from one person. Nothing ships that fails its own exit criterion.
-
M0
Done
Live browser demo at cypherkey.io
Clean repo, zero-knowledge docs, one-pager. Exit: a stranger fails and you pass, 4 of 5 times, on a hotspot.
Sep 14 2026 -
M1
Done
Zero-knowledge core and server
Argon2id, HKDF, AES-GCM; Hono + Drizzle; Phantom Keys; docker compose self-host. Exit: full signup → enroll → login → vault integration test in CI on SQLite and Postgres.
Oct 20 2026 -
M2
In progress
Chrome MV3 extension and private beta
Rhythm Light, Recovery Kit, domain autofill, hosted API. Exit: 25 users for 14 days, zero data loss, median unlock under 4 s.
Dec 05 2026 -
M3
Scheduled
Public launch
HN / Product Hunt. Adaptive thresholds, passkey and TOTP step-up, Pause mode, external crypto review published.
Jan 20 2027 -
M4
Scheduled
Revenue and reach
Stripe billing, breach monitoring, native CLI with terminal raw-mode capture, emergency access. Exit: first 100 paying customers.
Mar 31 2027 -
M5
Scheduled
SDK and Progressive Enrollment
@cypherkey/sdk, service dashboard, Teams tier, rhythm-gated passkeys. Exit: three external services integrated.
Jun 30 2027 -
M6
Scheduled
IdP and mobile
OIDC provider mode, read-only mobile vault, SOC 2 readiness.
Sep 30 2027
Open source
Client
Server
Self-host
Disclosure
The repository is public. Licences were fixed before it opened.
AGPL-3.0
Run it for yourself freely. Run it for other people and your changes are theirs too.
docker compose up
One command, SQLite by default, Postgres when you want it. No account with us at all.
security@cypherkey.io
Report anything you find. Coordinated disclosure, credited, and no legal threats.
How it's safe
01
02
03
04
05
06
07
08
Honest about the limits. Exact about the guarantees.
Zero-knowledge server
Stores only Argon2id(authHash) and wrapped ciphertext. Never sees the master key, wrap key or plaintext vault.
Frictionless second factor
A password leaked from a breach cannot unlock the vault without reproducing the timing cadence of your hands.
Data minimization
Raw keystroke events and feature vectors are never stored or logged. Only means and floored variances remain.
The Rhythm Light guarantee
No capture without a visible indicator. The code throws if the light is missing or obscured.
No lockout by your body
Pass, amber retry, step-up via passkey / TOTP / Backup Code, and Pause mode. Fatigue or injury never locks you out.
Replay-resistant signing
Each device holds an Ed25519 keypair and signs nonces, timestamps and payload hashes on every request.
A way back in
A Recovery Kit at signup, shown once. Ten one-time Backup Codes for the smaller case: a new keyboard, a broken wrist.
No score, ever
You are told the band and a sentence, never a number. A live score is the one thing an attacker could tune against.
If someone watches you type in person and is very good, maybe. That is why a new device always asks for a second confirmation. The attack this defeats is the real one: a password leaked from a breach, used from somewhere else.