Your credentials. Encrypted. In your hand.
paXCry is a USB password manager stick: credentials are stored encrypted on the device and retrieved via PIN directly on the stick - it types them in like a keyboard, with no software needed on the target device.
What is paXCry?
paXCry consists of two parts: a small USB stick with its own display and three buttons, which stores credentials (name, username, password) AES-encrypted - and a PC app for conveniently managing those credentials (add, edit, back up, restore).
On the stick itself, you enter a PIN and select a saved entry - the stick then types the username and password directly into the currently active window, just like a regular USB keyboard. This works on any device with a USB port, with no additional software required.
Features
PIN protection with lockout
4-digit PIN with increasing lockout time after failed attempts and automatic wipe after 10 failed attempts (customizable) in a row - protection against systematic guessing.
Per-device encryption
Every stick generates its own unique encryption key via a genuine hardware random number generator - no key shared across all devices.
Types like a keyboard
No app needed on the target device: the stick outputs credentials as USB keyboard input - works on PCs as well as smartphones with a USB port.
Jump to entry by first letter
Even with many saved entries, jump straight to the one you want in just a few button presses instead of scrolling.
Automatic lock
The stick locks itself without any button press, and the display turns off to save power - built for everyday use without manual locking.
Encrypted backup
The PC app lets you back up all credentials with password protection (AES-256-GCM, Argon2id) and restore them to any stick.
How it works
-
1
Connect
Connect the stick to the target device via USB.
-
2
Enter PIN
Enter the 4-digit PIN using the three buttons on the device.
-
3
Select entry
Select the desired entry from the list.
-
4
Done
Username and password are automatically typed into the active window.
Frequently asked questions
Tap a question to expand it.
Does anything run in the cloud?
No. Your credentials live on the stick and nowhere else. There is no user account, no synchronisation through a server and no component running on the internet. The backup, too, is an ordinary file that stays wherever you put it.
That was the very reason paXCry exists: a password manager that works without anyone else's servers.
What happens if I lose the stick?
Without the PIN, nobody can reach the stored data. Each failed attempt makes the waiting time longer, and after 10 failed attempts in a row the stick wipes itself completely - even if power is removed in between.
That is why an up-to-date backup matters: it lets you restore your credentials onto a new stick.
What if I forget the PIN?
Then you cannot reach the stored data any more. There is no back door and no recovery code - that would be exactly the gap an attacker would look for. This is what the backup is for.
Do I need an app on the target device?
No. The stick registers as a USB keyboard and types the username and password into whatever window is active. That works on any device with a USB port, including one that is not yours.
What is the PC app for, then?
For managing things: adding, editing and deleting credentials, generating passwords, and creating and restoring backups. You do not need it for everyday use - the stick alone is enough for that.
Why can a password not contain a semicolon?
The semicolon separates the individual fields in the connection between the PC app and the stick. In the middle of a password it would make the stick start a new field there and discard the rest.
Every other special character is allowed, and the password generator uses them.
How many credentials fit on the stick?
Currently 32 entries. The name may be 31 characters long, the username and password 63 each.
How secure is the backup?
The backup file is encrypted with AES-256-GCM; the key is derived from a password of your choosing using Argon2id. Any tampering with the file is detected when restoring.
That password cannot be recovered. Without it the file is worthless - to you as well.
Does the stick work with a smartphone?
Yes, provided the device accepts USB peripherals (USB OTG). The stick behaves exactly as it does on a PC.
Which operating systems does the PC app support?
Ready-made installers are available for Windows and Linux. A macOS build does not exist yet.
Why a separate device instead of just a program?
A password manager on your PC is only ever as secure as that PC. paXCry keeps the credentials on a separate device that does this one job and can be unplugged.
That does not remove the risk entirely: if the computer you plug the stick into is already infected, malware there can read what is typed. That is true of any keyboard.
Can I buy paXCry yet?
Not yet. paXCry is a working prototype, not a finished product. As soon as that changes, it will be announced on this page.
Availability
paXCry is currently a functional prototype and not yet a finished, publicly available product. The core security mechanisms are already active and working, but the project remains under active development.
Interested or have questions about the project? More information will follow on this page as it becomes available.
For more information, you can reach me at markus@jucama.at
Contact
Questions or interested in the project? Write to me directly.
Your details are used only to answer your inquiry and are not passed on - see the privacy policy.