OnlyKey
Offline Credential Storage, Two-Factor Authentication, Passwordless Login, SSH and OpenPGP Key Storage, Travel With Plausible Deniability
Overview
OnlyKey from CryptoTrust is a USB security token that doubles as a hardware password manager, a two-factor key and a file encryption token, all unlocked by a single PIN. It holds up to 24 accounts in two profiles of 12 slots, storing each login URL, user name, a password of up to 56 characters and a two-factor code, then types them into the computer over its own USB keyboard interface when you press a button. The security model is the part that separates it from cheap keypad vaults: the firmware is open source and published on GitHub, releases are signed and hash verified by the bootloader, stored data is encrypted with AES-256-GCM, the PIN is entered on the device's own six button keypad so a keylogged computer never sees it, ten failed unlock attempts wipe the data, and there is an optional self-destruct PIN. OnlyKey also covers FIDO2 and U2F, YubiKey compatible OTP, TOTP, OpenSSH and OpenPGP, and its encrypted backup (passphrase or PGP key protected) can be restored onto a spare unit. It has no battery and no display, using a single multicolour LED for status, and it is sold direct at onlykey.io with the standard model listed as inventory on the way and the USB-A plus USB-C DUO variant in stock at the time of writing. The honest caveat is capacity and ergonomics: 24 stored accounts is far fewer than a phone app vault, the firmware update and configuration process assumes a reasonably technical user, and the vendor publishes no independent third-party security audit even though the design is open to inspection.
Key Highlights
- Hardware password manager, FIDO2 and U2F security key, YubiKey OTP and TOTP token, SSH and OpenPGP key store and file encryption token in a single USB device
- Open source firmware on GitHub with signed releases, bootloader signature and hash verification on every use, and AES-256-GCM encryption of stored secrets
- PIN is typed on the device's own six button keypad, never on the computer, and 10 failed attempts erase all data, with an optional self-destruct PIN for total wipes
- Stores up to 24 accounts offline in two profiles of 12 slots, each with URL, user name, a password up to 56 characters and a two-factor code
- No battery at all, IP68 and MIL-STD-810G rated housing with a chemical resistant tamper evident coating, and encrypted backup restores to a spare unit
Technical Specifications
| Brand | OnlyKey |
|---|---|
| Model | OnlyKey |
| Storage Capacity | Up to 24 accounts in the device's own offline slots, arranged as two profiles of 12 slots, each holding a login URL, a user name, a password of up to 56 characters and a two-factor code; an unlimited number of accounts when used alongside a software password manager |
| Security | Open source hardware and firmware cryptography that differs from consumer keypad vaults: the firmware is published on GitHub, is signed by CryptoTrust, and the bootloader verifies both the signature and the firmware hash on every use. Stored data is encrypted with AES-256-GCM, protected by read and write protected Kinetis flash, and held on an offline secure processor that only accepts writes or wipes and requires physical touch to authorise a login. Backups are encrypted with a 25 character or longer passphrase or a PGP key, hardware is coated with a chemical resistant tamper evident compound, and the vendor states it meets many FIPS 140-2 requirements using FIPS approved algorithms (AES-256, Level 1). |
| Connectivity | USB-A male connector on the standard model (the OnlyKey DUO variant adds USB-C); no Bluetooth, Wi-Fi, NFC or internet connection, and the device presents itself to the host as a standard USB keyboard so no driver is needed on Windows, macOS, Linux, Chrome OS or Android |
| Display | No display; a single multicolour LED reports state, with steady green for the first unlocked profile, steady blue for the second, three red flashes for a wrong PIN, continuous red flashes when the PIN attempt limit is exceeded, white in bootloader mode and other fade patterns for signing, decryption and config mode |
| Keyboard | Six-button on-device keypad used to enter the 7 to 10 digit PIN and to pick a credential slot; the device then types the user name, password and one-time code into the connected computer as if typed on a keyboard |
| PIN Protection | A 7 to 10 digit PIN is entered on the OnlyKey's own keypad rather than on the computer, so a keylogger cannot capture it; after 10 failed unlock attempts all data is securely erased, and a separate self-destruct PIN wipes everything on demand while encrypted backups allow a restore |
| Battery | None; the device is powered entirely by the USB port it is plugged into, so there is no cell to replace or recharge |
| Memory Retention | Non-volatile flash memory keeps all accounts without any power source; a passphrase or PGP protected encrypted backup can be typed out to any computer and restored onto the same device or a spare OnlyKey |
| Dimensions | Not published |
| Price | $55.99 |
