ToothPaste: A Hardware-Backed Clipboard That Types Your Passwords Into Any USB Device
ToothPaste is an open-source ESP32-S3 gadget that acts as a wireless USB keyboard, letting you paste passwords and commands into BIOS screens, air-gapped machines, or sketchy computers without installing anything. It pairs over Web BLE, derives a session AES-256 key via ECDH, and on V2 stores private keys in a Microchip ATECC608B secure element so they never touch the ESP32's flash. A Rust TUI and MCP server even let an AI agent drive it.
Almost every USB-host compatible device supports using a keyboard as means of controlling it and, because this is presumed to be a direct extension of a user, it is implicitly trusted (keyboards don't have passwords because how would you enter the password).
- pluc
Because the title and name are undescriptive af:
ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
- alhadrad
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory.
There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example:
{credstore myusername}
{TAB}
{credstore mypassword}
{ENTER}
- evan_a_a
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.