OnlyKey

OnlyKey is a hardware device that combines a password manager, a two-factor (2FA/MFA) security key, and a file encryption token. This device protects online accounts and data, functioning even if the computer or website being used is compromised. It supports multiple authentication methods such as FIDO2, U2F, TOTP, and Yubico OTP, and works with any operating system and web browser.

★★★★★

2.0(1 ratings)

• Hardware password manager. OnlyKey securely stores login credentials on the device. When connected to a computer, it can automatically enter usernames and passwords via keyboard emulation, eliminating the need to remember complex passwords or type them manually. This feature protects against keyloggers and other malware that attempt to steal credentials.
• FIDO2 / U2F security key. It functions as a physical security key for passwordless login or as a second authentication factor. It is compatible with the FIDO2 and U2F standards, supported by websites and services like Google, Microsoft, Facebook, GitHub, and Dropbox for robust protection against phishing attacks.
• TOTP code generator. The device generates time-based one-time passwords (TOTP), similar to those from apps like Google Authenticator. This allows it to be used as a second factor on services that do not support physical security keys, either by displaying the code or entering it automatically, keeping the secret seeds safe within the hardware.
• Yubico OTP support. OnlyKey is compatible with the Yubico one-time password format (Yubico OTP). It can function as a direct replacement for YubiKey keys in services and applications configured to accept this type of authentication token, ensuring interoperability with existing systems.
• Challenge-response authentication. It offers support for challenge-response authentication mechanisms. This functionality is used in applications like the pam_yubico module for Linux, allowing secure access to systems and servers via the device, which enhances security in network administration environments.
• File and message encryption. The device can generate OpenPGP keys and securely store the private key. This allows it to be used for encrypting and decrypting files, emails, and messages, as well as for authentication in protocols like SSH, keeping private keys inaccessible to the computer's software.
• PIN protection with self-destruct. The device's security is activated by a PIN entered directly on OnlyKey's own numeric keypad, not on the computer. If the device is stolen, the data remains encrypted; after 10 failed PIN attempts, all stored information is securely erased, protecting secrets even in the event of a physical attack.
• Physical resilience and durability. Manufactured with an epoxy-filled polycarbonate case, the device is water and dust resistant with an IP68 certification and meets the MIL-STD-810G military standard for resistance to drops, shocks, and extreme temperatures, ensuring its portability and durability in adverse conditions.
• Secure backup and restore. It allows creating an encrypted backup of all stored configurations and data. This backup can be restored to another OnlyKey device, making it easy to have a secure duplicate without compromising information, ensuring continuity of access in case the primary device is lost or broken.
• Cryptographic token functionality. In addition to web authentication, it acts as a hardware token for professional cryptographic tasks. It can store keys and perform cryptographic operations for SSH, OpenPGP, and disk encryption, keeping private keys isolated from the computer and preventing their exposure to malware.

The OnlyKey project was started in 2015 by Tim Steiner, with the goal of creating a hardware security solution that did not rely on a battery and was user-verifiable. The development of the firmware and software is carried out by CryptoTrust. The device's core logic is programmed in C for the microcontroller, while the complementary desktop applications are developed in Python.

Alternatives to OnlyKey:

2FAGuard

2FAGuard is a Windows application that manages two-factor authentication codes.

Price: Free   Size: 51.9 MB   Version: 1.8.0   OS: Windows

IronClaw

IronClaw is an open-source alternative to OpenClaw, engineered to run artificial intelligence agents with a defense-in-depth security model.

Price: Free   Size: 21.2 MB   Version: 0.13.0   OS: Windows, Linux, MacOS

PearPass

PearPass is an open-source password manager that operates locally.

Price: Free   Size: 18.4 MB   Version: 1.1.1   OS: Windows, Linux, MacOS, Android, iOS

Axcrypt

AxCrypt is a file encryption software that uses AES algorithms to protect individual documents.

Price: Free   Size: 89.35 MB   Version: 3.0.0.40   OS: Windows, MacOS, Android, iOS