Twenty-five years scaling global engineering organisations, and one observation he never managed to put down: that the way a person types is as much theirs as the way they walk. CypherKey is that observation, finally built properly.
In 2007 Shawn built Keystroke Captcha: a telemetry script inside a custom MVC framework that listened to key events and decided whether a form was being filled in by a human. It worked. It also did something he had not asked it to do — the dwell and flight timings did not merely separate people from machines, they separated one person from another.
In 2010, at CBSSports.com, he pointed it at passwords. He handed his own credentials to teammates and watched them fail to log in, then logged in himself on the first try. As far as he has ever been able to establish, that was the first working keystroke-dynamics authentication prototype running against real production logins.
Then he put it down for sixteen years and went and built other things. The signal did not go anywhere. Every login on earth still produces it.
Twenty-five years leading and scaling global engineering organisations, at LinkedIn, Gusto, Apartment List, Ultimate Software and Fidelity Investments. Identity, payroll, marketplaces and financial infrastructure — four industries where getting authentication wrong is the whole story.
CypherKey is not a deck. The cryptography, the scoring maths, the extension, the server and this site were built and are maintained by Shawn at Irietek, with modern agentic tooling and a test suite that says out loud which of its own guarantees it cannot check.
The average person now manages around 120 passwords, and roughly 39% of breaches start with a stolen credential. The 2010 prototype answered that problem before the problem was this bad. Sixteen years of watching it get worse is the reason this exists.
He answers email, and he would rather hear that something in the threat model is wrong than that the site looks nice.