theVault. Your vault for your pocket.

What is theVault?

How it works

1. 1

   Connect

   Connect theVault to the device via USB.

2. 2

   Enter PIN

   Enter your PIN of at least eight digits using the three buttons. The digits sit in a grid that is reshuffled after every position.

3. 3

   Choose

   Pick an entry on the stick – or, for a passkey sign-in, simply confirm on the device.

4. 4

   Done

   theVault types the username and password into the active window, or the service signs you in with your passkey.

Availability

What's new?

What has changed since the first public release.

paXCry - What's New?

https://paxcry.com

This list starts with the version that was first handed to testers. Whatever
happened during development before that is not in here.

Newest first.


theVault · App 0.11.6.0 · Firmware 0.2.34.2 — 11 October 2026
-------------------------------------------------------------

- NEW: The app has a help section.

  Until now a paragraph under every control explained what it does. Each
  one was correct, and together they crowded out what matters: you read
  them once and see them a thousand times. Those paragraphs have been
  rewritten into eight collapsible sections behind the question mark in
  the header - in German and in English.

  What stays next to each field is what you need there: the input rules
  and the warnings. Having to look those up in a help section means the
  mistake has already happened.

- NEW: Passwords and user names can be copied straight from the vault
  list.

  The “PWD” column carries a copy button for each entry, and the user
  name is clickable. Both put the value on the clipboard and clear it
  again after 30 seconds. No need to open an entry for it any more.

- NEW: The window remembers its size - and whether it was full screen.

  It comes back the way you closed it. Leaving full screen restores the
  previous size.

- Two passkeys for the same service now work.

  Anyone who had registered two passkeys with one service could not sign
  in with either of them. Only that combination was affected; with a
  single passkey per service the case never arose. This needs a firmware
  update to 0.2.34.2.

- The PC software was security-audited and hardened in five places.

  The entire source code was reviewed by an independent party. No holes
  were found through which credentials could be read - but five places
  where the software can carry more defence. All five are fixed. The two
  that concern you:

  When the vault is locked, the master key and the plain text are now
  overwritten instead of merely released. Released memory keeps its
  contents until something else overwrites them - so they can end up in a
  swap file or a crash report.

  And the program window now has a strict security rule (Content Security
  Policy). It prevents injected code in the window from reaching your
  credentials at all. The software was not vulnerable before either - but
  that rested solely on every text output being written carefully. Now the
  rule forbids it.


theVault · App 0.11.3.0 · Firmware 0.2.34.1 — 7 October 2026
------------------------------------------------------------

- NEW: The app is now available for macOS as well.

  One file for Intel Macs and for Apple Silicon. It is in the download area
  as a .dmg.

  IMPORTANT: It is not notarised by Apple. On first launch macOS will
  therefore report an unidentified developer. In that case open it once from
  the context menu (right-click the app icon, then “Open”); after that it
  starts like any other application.

- NEW: Fourteen keyboard layouts, selectable on the stick itself.

  macOS assigns the same keys differently from Windows and Linux. A password
  containing an “@” therefore arrived on a Mac as “«” - without any error
  message, the sign-in simply failed. Every character typed with AltGr was
  affected: @ ~ | \ { [ ] }

  The stick now carries fourteen layouts, among them separate Mac versions
  for German/Austrian, Swiss, British, French and Italian keyboards. You can
  pick one on the device: in the settings menu under “Keyboard”, or by
  holding the LOWER button inside an opened account - that is, exactly where
  you notice that characters come out wrong.

  Which layout is set now shows at the top left of the display, on the lock
  screen as well. That way you see it before anything is typed. In the app
  you can decide which of the fourteen are offered on the stick.

- NEW: In the download area the manual is now a PDF, no longer a Word file.

  It is the same booklet that ships with the device: A6 landscape, with a
  table of contents, note pages and an imprint. To reprint it, choose
  “Booklet” in the print dialog - otherwise you get 28 small single pages.

- Note: On older computers, with poor cables or depending on which way round
  the plug goes in, the stick may not be recognised immediately. Unplug it
  and plug it back in.


theVault · App 0.11.2.0 · Firmware 0.2.31.0 — 2 October 2026
------------------------------------------------------------

- NEW: Passwords can be generated on the stick itself.

  Until now this needed the app. The device is enough now: in an account
  select “Password” and hold the UPPER button. The stick asks back - up
  means “No”, down means “Yes” - and then creates a new random password of
  15 characters.

  The question deliberately sits on the opposite button: you got here with
  the upper one, so a press held too long says “No”.

  The stick only uses characters your selected keyboard layout can actually
  type. That way no password can be created which it could not type out
  afterwards.

- NEW: A way back if the change at the service fails.

  Hold the LOWER button on the same item and the stick brings back the
  previous version. It is a swap: press again and you are back at the new
  password - so a wrong move costs nothing.

  Exactly ONE previous version is kept. Create a second new password and
  the original one is gone. So change it at the service right away and
  check that signing in still works.

- NEW: The registration button in the app shows the state and toggles it.

  There is now a button next to the settings at the top: red means “this
  stick is not registered here”, green means registered. Clicking red
  registers, clicking green unregisters.

  This is mainly meant for other people's computers - if you want to
  unregister quickly there, you no longer need the detour via the settings.
  The button disappears as soon as the stick is unplugged.

- CHANGED: After the express PIN, registration asks for the normal PIN.

  Same as with passkeys. The stick shows the entry on the device and the
  app waits for it. Before, registration was simply refused in this case,
  without any way to tell why.

- CHANGED: The account list in the app clears as soon as the stick is gone.

  Before it stayed on screen and showed the accounts of a device that was
  no longer plugged in.

- CHANGED: The clock of the stick can only be set by a registered app.

  Nothing changes for you - the app does it by itself. But any other
  program on the computer can no longer change the clock.


theVault · App 0.11.0.0 · Firmware 0.2.28.0 — 1 October 2026
------------------------------------------------------------

- NEW: The stick now only releases credentials to a registered app.

  Until now only the app checked the stick. Now the stick checks the app
  as well: another program on your computer can no longer list, create or
  delete your accounts - not even while the stick sits in APP mode.

  Registration happens once per computer. Click “Register app” in the
  settings and hold the middle button on the device when “PAIR APP”
  appears. That hand movement is the protection: malware cannot perform
  it.

  Every stick and every computer is registered separately. After the stick
  has been reset, it needs to be registered again - the app will say so.

  Details in section 4.7 of the user manual, including what this
  protection does NOT do.

- CHANGED: The stick no longer asks for your PIN before “APP”.

  That second entry has been replaced by the app registration. Its purpose
  was to keep a stick left unlocked from handing over all credentials -
  the registration now does that, and does it better.

  The PIN prompt before “Backup” stays. There the credentials are typed
  into some other window, and a registered app says nothing about that.

- NOTE: With the express PIN the app receives no credentials.

  APP mode itself opens, but registration only succeeds with the normal
  PIN. The same limit has always applied to passkeys and companion
  devices.

- NOTE: Firmware update, diagnostic report, setting the clock and the
  recovery after a wipe still work without registration.

  A rescue path must never depend on whatever is currently broken.

- NOTE: This version raises the rollback version. Once it has started, no
  older firmware can be installed any more.

  That is deliberate and part of the protection above: earlier versions do
  not have the lock. If they stayed installable, it could be bypassed by
  simply changing the firmware.


theVault · App 0.10.3.2 · Firmware 0.2.27.2 — 30 September 2026
---------------------------------------------------------------

- NEW: The authenticity check now asks the stick a random question.

  The app has always checked whether the device holds a genuine security
  chip, and whether we countersigned that exact chip. Both of those are
  public, though, and they read the same every time - a counterfeit could
  copy them from a genuine stick and get through.

  The app now also draws 32 random numbers and has the stick sign them.
  Only the chip itself can do that, with a key that never leaves it - and
  there is nothing to copy, because the question differs every time.

  If a device does not answer, or answers wrongly, the app now says so in
  red. With a genuine stick that cannot happen.


theVault · Firmware 0.2.26.0 — 28 September 2026
-------------------------------------------------

- CHANGED: PIN entry now runs in two pictures, and both button presses are
  the same movement.

  The first press picks the row your digit is in, as before. The stick then
  shows only those three digits, one above the other - again right beside the
  button that means them. The second press picks the digit.

  An example: you need the 6, and the grid shows “1 5 3” at the top, “7 2 6”
  in the middle and “7 8 9” at the bottom. The 6 is in the middle row, so you
  press the middle button. Only “7”, “2” and “6” are then left - with the 6 at
  the bottom. One press on Down, and the digit is entered.

  Before, the second press was a small calculation: the digits stood side by
  side while the buttons sit one above the other, so you had to work out which
  button matched left, middle or right.

  Nothing changes about security: the grid is still reshuffled after every
  digit, and it is the same two presses - only shown differently.


theVault · Firmware 0.2.25.0 — 27 September 2026
-------------------------------------------------

- CHANGED: PIN entry now picks the ROW first and the column second - it used
  to be the other way round.

  The reason is the device itself: the three buttons sit one above the other
  next to the display, and the three rows of the digit grid line up with
  them exactly. The first press therefore points to where the button is.
  Before, pressing the middle button highlighted the middle column while the
  digit you wanted might be at the top - you had to keep two directions in
  your head.

  On the second press, top means the left digit of the chosen row, middle
  the middle one and bottom the right one. Holding Down still goes back a
  step.

  Nothing changes about security: the grid is still reshuffled after every
  digit, so the sequence of presses gives the PIN away no more than before.


theVault · App 0.10.2.1 · Firmware 0.2.24.4 — 27 September 2026
---------------------------------------------------------------

- NEW: Every stick identifies itself to the PC app. Its secure element comes
  with a certificate from its maker; the app checks that signature against
  Infineon. On top of that, Jucama KG has countersigned that very chip. The
  two together answer the question of whether a device really came from our
  production.

  You will find the result in the settings under “Check authenticity”.

- IMPORTANT: The app now transfers credentials only to sticks that pass this
  check.

  Why that is needed: a counterfeit device needs neither a display nor a
  secure element – it is enough to behave towards the app like a new stick.
  If you then restore a backup, it is decrypted on the PC and every entry is
  sent to that device in the clear. The serial number is no help here: it is
  printed on the label, and any device can claim it freely.

  What still works, even on a stick whose authenticity is unconfirmed: the
  firmware update, the diagnostic report and the recovery after a wipe. Those
  routes stay open on purpose – otherwise a device with outdated firmware
  could never be put right again.

  What the check does NOT do: it does not detect a counterfeit that has
  copied the certificate and the countersignature from a genuine stick. Both
  are public and unchanging. That gap will only be closed by a future step in
  which the stick answers a random challenge with its own key.

- Smaller firmware fixes: the stick now hands out its countersignature in
  full, and the help shown for an unknown command lists all commands again.


theVault · Firmware 0.2.22.0 — 26 September 2026
------------------------------------------------

- REMOVED: The stick no longer hands out the recovery key, and the menu item
  “Rescue key” is gone. It was meant for a hardware failure: with the noted
  key, the secure element could be moved into a new device. On a potted stick
  that route is not worth it – the effort involved far exceeds the price of a
  new device. What remained was mainly the risk: anyone who gets hold of both
  the slip of paper and your stick can use it to bypass the lockout after too
  many failed attempts.

  Nothing changes for you day to day. If a stick is lost or fails, the rule is
  unchanged: your credentials come back from the backup file, which you
  restore onto a new stick. Passkeys are excluded – they are tied to the
  secure element and have to be set up again with each service. So keep making
  backups regularly.

  If you have written such a key down on paper: it is no longer needed, and
  you should destroy it.


theVault · App 0.9.8.0 · Firmware 0.2.20.1 — 24 September 2026
--------------------------------------------------------------

- CHANGED: The recovery key is now handed out by the stick alone, no longer
  by the PC app. Under “Rescue key” in the menu you choose whether it is shown
  on the display or typed like a keyboard into an open text field. That way
  this key never leaves the device over the connection to the PC. The normal
  PIN is always required for it.

- CHANGED: Access to APP mode, the keyboard backup and the recovery key now
  requires the normal PIN. An express unlock is no longer enough - so nobody
  can reach your credentials or the recovery key with the express PIN alone.

- CHANGED: Recovering a stick now runs in one go. After starting it you set a
  new PIN once, the stick sets its secure element up again by itself and is
  ready to use straight away - the earlier detour via “Check SE” is gone.

- CHANGED: The automatic wipe after too many failed attempts now also takes
  effect when the stick runs on battery and cannot be unplugged. It restarts
  by itself after the wipe and is locked.

- NEW: Clearer guidance during first-time setup, including a plain statement
  that there is no spare key.


theVault · App 0.9.5.1 · Firmware 0.2.17.3 — 19 September 2026
---------------------------------------------------------------

- NEW: Passkeys after the express PIN. If the stick is unlocked with the
  express PIN and a site wants a passkey, it opens the normal PIN entry by
  itself (“passkey” at the top of the display). The browser waits meanwhile,
  and you then confirm the sign-in as usual. A long press on Down while the
  entry is still empty cancels. A wrong PIN locks the stick completely. On a
  locked stick nothing changes: a passkey request opens no prompt there -
  unlock it first.

- CHANGED: The backup reminder no longer appears merely because a passkey was
  created - passkeys cannot be backed up anyway. And after restoring a backup
  onto an empty stick, that stick counts as backed up, so the reminder at the
  next unlock is skipped.


theVault · App 0.9.5.0 · Firmware 0.2.16.2 — 17 September 2026
---------------------------------------------------------------

- NEW: EXPRESS PIN. Four digits, set on the stick under “Express PIN” in the
  settings. It stands in front of APP mode and the backup, and after idle
  time, five minutes of use or APP mode it is good for unlocking for 30
  minutes. There is only one attempt - after that, and after a long press on
  Select, the normal PIN applies again. Passkeys always need the normal PIN.
  In the app you can set for how many hours (8 by default) and for how many
  express unlocks (10 by default) it lasts, or switch it off entirely.

- CHANGED: The confirmation “send ALL secrets for 2 min?” now lasts exactly
  two minutes from the button press and no longer extends while the app keeps
  reading.

- The wipe threshold is 9 failed attempts by default and can be set between 5
  and 9. The manuals still said 10.

- Passkeys: a second program on the computer can no longer cancel a sign-in
  that is already under way.

- The diagnostic report now says whether an express PIN is set and how long it
  lasts - and which PIN was used for the last unlock. The PIN itself never
  appears there, no more than your credentials do.


theVault · App 0.9.4.3 · Firmware 0.2.15.1 — 15 September 2026
-----------------------------------------------------------------

THE PAXCRY STICK BECOMES theVault. From now on paXCry is the name of the
brand and theVault the name of this product - more will follow. The app keeps
the name paXCry for the time being.

- NEW SECURE ELEMENT: Infineon OPTIGA Trust M. The PIN is checked by the chip
  rather than by the firmware, and the key to your credentials only comes into
  being together with it. Failed attempts are counted by the chip itself.

- PASSKEYS: theVault is a security key to FIDO2/WebAuthn, including
  hmac-secret and credProtect. Passkeys cannot be backed up and cannot be
  moved to a second device - that is intended, they are tied to the secure
  element. For a spare device, register it with each service as well.

- SIGNING IN ON THE PC: sign in on the computer with the unlocked stick,
  without typing your password. For Linux at first.

- PIN OF AT LEAST EIGHT DIGITS. During setup and when changing the PIN,
  theVault now requires eight to ten digits. An existing shorter PIN is still
  accepted - change it anyway.

- SIGNED FIRMWARE. The firmware in the download area is signed and only starts
  on theVault devices with secure boot. It raises the rollback version: once
  it has started, no older firmware can be installed any more.

- RECOVERY KEY: during setup theVault hands out a key for you to write down.
  After a hardware failure it reconnects a replacement microcontroller with
  the secure element. It does NOT replace a backup.

- This firmware only fits theVault devices with the new secure element and
  secure boot. Older prototypes cannot be updated with it.

- Make a backup before every firmware change.


App 0.9.4.0 · Firmware 0.2.3.8 — 22 August 2026
------------------------------------------------

- NEW: Diagnostic report in the app's settings. One click saves the state of
  the stick as a text file - firmware, secure element, failed-attempt counter,
  clock, battery, plus the app version and your operating system. Simply
  attach it when you ask us something.
  The file contains NO credentials, and that is stated in its header too.

- The stick's clock now survives a loss of power. The backup switch-over was
  disabled from the factory - so the built-in cell sat there doing nothing,
  and the time was gone after every disconnect. The stick sets this up once
  during unlocking.
  Why it matters: without a valid clock it hands out no one-time codes.

- In APP mode the divider at the top edge now also shows how much time is left
  before locking. Until now it stood still there.

- The info screen has a third page with measurements of the power supply.


App 0.9.3.1 · Firmware 0.2.0.0 — 20 August 2026
------------------------------------------------

THE FAILED-ATTEMPT COUNTER NOW LIVES IN THE SECURE ELEMENT ITSELF.

- Until now the firmware counted the wrong PIN entries. That is enough against
  anyone operating the stick normally - but not against someone who opens the
  case and addresses the secure element directly. Such a person could guess
  past the counter. Now the chip counts every attempt itself, including that
  one.

- WHAT THIS DOES NOT DO, and that belongs said: the chip RECORDS such an
  attacker, it does NOT STOP him at ten attempts - the limit of ten is still
  drawn by the firmware, and that is exactly what he is bypassing. What really
  slows him down is the length of your PIN: every single attempt costs the
  chip about a second, and that cannot be shortened. Four digits are therefore
  exhausted in roughly two hours, six in a good week. From seven digits on,
  the internal counter reaches its limit before all possibilities are through
  - the chip then makes itself unusable, and the credentials are gone for good
  rather than given away.

- SO USE AT LEAST SEVEN DIGITS, BETTER EIGHT. The stick allows 4 to 10; the
  four digits of earlier days are the weakest choice today.

- If the secure element is replaced, the stick wipes its credentials at the
  next start - without asking. A finished stick is potted: anyone who reaches
  the chip has opened it. There is nothing to be gained anyway, because the
  data is tied to the key of the old chip.

- The info screen now states the actual type of the secure element.


App 0.9.3.1 · Firmware 0.1.36.0 — 16 August 2026
-------------------------------------------------

The first version handed out for testing.

What the stick can do:

- Store credentials encrypted and type them into whatever window is active at
  the press of a button - without anything having to be installed on the
  computer.

- Calculate one-time codes (TOTP) itself. The second factor is then no longer
  on the same phone as the first sign-in.

- Passkeys, including sign-in WITHOUT a username. The stick remembers a
  passkey itself and finds it from the address of the service alone; your
  passkeys appear under that address in the stick's menu as well.

- The PIN is entered on the device and never leaves it. It is checked by the
  secure element, not by software.

What you should know while trying it out:

- One-time codes can also be kept in the app's vault. That is the only way to
  get the same login including its second factor onto a second stick. Passkeys
  do NOT travel this way - they are bound to one stick and have to be
  registered separately with each service for each stick.

- Under the menu item “Info” a second page shows the stick's date and time
  (press Down to get there). This lets you check without a PC whether the
  clock is right - the one-time codes depend on it. The time shown is UTC, so
  one to two hours earlier than our time zone.

- If the stick ever stops responding: hold all three buttons for five seconds
  and it restarts. The credentials are kept.

- PLEASE MAKE A BACKUP before you store anything you actually rely on. There
  is no spare key: with a forgotten PIN or a hardware failure the credentials
  are lost for good. The stick reminds you of this and gets more insistent
  over time.

- WATCH THE DISPLAY while the PC app is working. You confirm the access once
  on the device; it then stays open for two minutes and extends while the app
  is working. During that time the stick shows continuously which entry is
  being read, written or deleted. If something happens there that you did not
  start, something is wrong.

- When restoring a backup, a summary appears at the top: how many accounts
  came back, and how many of them brought their one-time code along.

- Some services require an attestation from the manufacturer of a security key
  (common in companies and public authorities, sometimes banks). paXCry
  deliberately does not provide one - it would be a marker allowing
  recognition across services. Those services will refuse the stick.

- paXCry is a working prototype, not an independently certified security
  product. Shipped devices only start signed firmware (secure boot); an
  independent security certification is still outstanding.

Go to downloads