SecureGen is an open-source hardware device that combines TOTP authentication and password management. Featuring AES-256 encryption and a BLE keyboard, it provides 7-layer security and works offline, ensuring your sensitive data remains protected. Perfect for those seeking a reliable security solution in a multifunctional package.
SecureGen — Hardware TOTP Authenticator & Password Manager
Open-source security device on ESP32 T-Display. TOTP/HOTP codes + encrypted password vault + BLE keyboard. Works completely offline. Flash from browser in 2 minutes.
Why Hardware?
Verifiable Security
- Audit every line of code yourself
- No cloud, no remote attacks, no trust required
- Physical isolation — your secrets never leave the device
8-Layer Web Defense Architecture
- ECDH Key Exchange — ephemeral P-256, HKDF-derived AES session key
- AES-256-GCM Transport — end-to-end encrypted requests and responses
- URL Obfuscation — endpoints rotate every 30 reboots, block automated scanners
- Header Obfuscation — fake headers hide tech stack from fingerprinting
- Traffic Obfuscation — periodic decoy requests mask real usage patterns
- CSRF Protection — session-bound tokens on every mutating request
- Method Tunneling — all HTTP methods hidden behind single POST tunnel
- Session Management — 128-bit IDs, LRU pool, encrypted persistence
Key Features
Security
- AES-256-GCM encryption for all data at rest
- PIN-derived device key via PBKDF2-HMAC-SHA256
- Persistent PIN lockout — 5 attempts across reboots
- Secure RAM wipe before deep sleep
- LE Secure Connections for BLE (MITM protection)
Functionality
- TOTP + HOTP (RFC 6238 / RFC 4226) — SHA1/256/512, 6 and 8 digits
- QR code import and export directly on device screen
- Encrypted password manager with BLE HID keyboard output
- Web management cabinet — multilingual (EN / RU / DE / ZH / ES)
- DS3231 RTC module support — accurate TOTP in Offline and AP modes without WiFi
- Three boot modes: WiFi / AP hotspot / fully air-gapped Offline
- Offline decrypt tool — inspect and edit exports without the device
Hardware
- LILYGO T-Display ESP32 (~$10)
- 1.14" color TFT display (135×240)
- Battery powered with charging animation
- Two-button navigation
Perfect For
✅ Privacy-conscious users wanting verifiable security
✅ Self-hosters building secure local infrastructure
✅ Anyone tired of trusting closed-source authenticator apps
✅ Makers learning embedded security and cryptography
Technical Highlights
- Application-layer HTTPS-equivalent without TLS certificates
- Memory-optimized BLE + WiFi strict mode separation (520KB RAM)
- iOS/Android adaptive BLE bonding parameters
- Light sleep power management — pseudo-sleep at 40MHz avoids GPIO0 crash
- Cross-platform BLE HID keyboard layout support
License: MIT — fully open source
Cost: ~$10 hardware + free software
Flash online: makepkg.github.io/SecureGen/flash
