Hardware-level encryptionTPB2

TouchPass Basic2

One touch, securely open

The smallest module in the series: a capacitive fingerprint module with a ring indicator plus a single USB port, ready the moment you plug it in. One fingerprint carries all three hardware-level authentication methods — HID password entry, PIV smart card and PassKey — and passwords and keys never leave the device.

USB 2.0 · wired10 fingerprintsESP32-S3HID / PIV / PassKey

One fingerprint, three kinds of authentication

The fingerprint is the device's single means of authentication. Every enrolled fingerprint can sign in to the app, open a PIV session and complete PassKey verification — you don't need to assign roles to your fingers.

HID password entry
Turns the device into a fingerprint keychain

Bind a password to a fingerprint. On a successful match the device types it out character by character over the standard USB keyboard protocol. All the system sees is an ordinary keyboard.

  • Works in login boxes, apps, web forms and terminals
  • Write-only — not even the app can read the password back
  • Optional auto-Enter submits as soon as typing finishes
Driver-free on every platform
PIV smart card
Sign in to your Mac with a fingerprint

The device enumerates as a standard PIV smart card (CCID): macOS login and lock-screen unlock, enterprise certificate sign-in and code signing all work.

  • ECC P-256 keys generated inside slots 9A / 9D
  • The PIN field is filled in by the device — nothing to memorise
  • Every use requires a fresh fingerprint (30-second session)
One-tap setup on macOS only
Passwordless sign-in with PassKey
A standard FIDO2 / WebAuthn security key

Register and use passkeys straight from the browser: no passwords, no verification codes — one touch signs you in. The credential's private key stays in the device's encrypted partition.

  • CTAP 2.0 / 2.1, backwards compatible with U2F
  • Up to 256 discoverable credentials
  • The fingerprint handles user verification — no PIN out of the box
Cross-platform

One exception: if you set an HID password containing letters or symbols for a given fingerprint, that fingerprint can no longer be used for PIV — the macOS smart-card PIN field accepts digits only. Fingerprints with no password, or with a numeric password of 6 digits or more, are unaffected.

How it works

The actual steps for all three capabilities — every one of them is configured in the TouchPass app.

01
Set the password in the app

Sign in to the TouchPass app, choose “Set password” on the fingerprint card, enter the password you want to bind and save. Once saved it cannot be read back — only overwritten or deleted.

02
Focus the input field

Put the cursor in the target password field. The device only types the password into whatever currently has focus, so check the focus before you touch.

03
Touch the sensor

A green flash and a short buzz mean the password has been entered; by default a Return is appended to submit it. Keyboard output is US-layout ASCII.

Security by design

Assume it is already in an attacker's hands

They have a soldering iron, a programmer, an oscilloscope and time. Even then they still cannot get your password — from the choice of silicon to the last step of factory programming, the entire chain is designed around that one assumption.

Your password sits at the very centre
Getting to it means going through every layer in turn
Vendor firmware signing service
Signing happens at build time; the private key is never written to the device
Only firmware signed with that key will boot
Home-built firmware is rejected both at flashing and at boot
Main MCU · ESP32-S3
eFuse blown · keys cannot be read out
Secure Boot v2 · signed firmware only
Flash encryption · XTS-AES-128 · unique key per device
part0 partition · PIV private keys / PassKey credentials
NVS encryption · one more key on top
Fingerprint pairing key
Your password
Write-only — there is no read interface at all
Fingerprint module

Fingerprint templates never leave the module, are stored encrypted, and there is no image export interface. A custom module, paired one-to-one with its own MCU.

Pairing keys KeyA / KeyB
Permanently locked after pairing
Firmware signing
Without the vendor private key, home-built firmware neither flashes nor boots; OTA goes through the same verification.
Flash encryption
The whole chip is XTS-AES-128 encrypted with a per-device key — desolder the flash and all you read is ciphertext.
Second NVS encryption
The config partition is encrypted again with a different key, so the most sensitive data is encrypted twice.
Factory module pairing
KeyA/KeyB are exchanged with this unit's module and then locked forever; swap the module and the keys no longer match, so authentication fails.
Encrypted link
Module and MCU talk over AES-128 with challenge-response, so tapping the traces yields ciphertext only.
eFuse blown
The fuses are blown at the factory: the flash key can be neither read nor rewritten, and JTAG is permanently disabled.
See the full security storyNot intended to stop a national laboratory with the budget and gear for chip decapping and laser fault injection — we state the boundary too.

Three kinds of PIN, one job each

The PINs on the device are independent of one another, and day to day there is only the first one you actually have to remember.

Ten wrong attempts in a row and the device wipes itself

This is the last line of defence once the device has been stolen. The failure count is stored persistently and survives a power cycle; any successful sign-in (PIN or fingerprint) resets it to zero. On by default — we do not recommend turning it off.

Admin PIN
4–18 characters
Signs you in to the TouchPass app to manage the device; any enrolled fingerprint works instead. The device ships without an admin PIN, so set one immediately — and make it long.
PIV PIN
Nothing to memorise
A formality macOS insists on; the device does not check its value — after a successful fingerprint match the device fills it in over HID. What actually authorises the operation is your fingerprint.
FIDO PIN
4–63 characters
Not set at the factory — user verification for PassKey is handled entirely by the fingerprint. You can set one when a service insists; eight consecutive failures lock it.

First thing out of the box: set the admin PIN. The device ships without one, and a factory reset clears it again — until it is set, the management channel is wide open. Make it long; don't settle for four digits.

Up and running in three steps

1
Plug it in

Plug TouchPass Basic2 into a USB port. HID and PassKey are driver-free on every platform — there is nothing to install.

2
Enrol a fingerprint

Open the TouchPass app, set the admin PIN, then lift and press five times to capture the print; set an HID password or initialise PIV as needed.

3
One touch, done

Touch the sensor to type a password, unlock your Mac, or complete PassKey verification.

The light and the buzz are the whole interface

Idle
Breathing light; colour and rhythm are customisable in the app (off by default)
Awaiting touch
Solid amber — FIDO confirmation, fingerprint sign-in to the app, and so on
Match
One green flash plus a short buzz
No match
Three red flashes plus a continuous buzz

There is no visible LED on the body; every state is expressed by the fingerprint module's RGB ring light and the vibration motor. Vibration can be turned off in the app, and the idle breathing light supports custom colours and rhythms.

Specifications

Core
MCU
ESP32-S3-N16R8 (16 MB flash, 8 MB octal PSRAM)
Fingerprint sensor
Capacitive module, encrypted UART link, built-in RGB ring indicator
Fingerprint capacity
10 (slots 1–10)
Connectivity
Port
USB 2.0 Full Speed (12 Mbps)
Composite device
HID keyboard + CCID smart card + FIDO2 + management serial
Wireless / battery
None (Basic2 is wired only)
Security
Firmware signing
Secure Boot v2 (RSA-3072), verified at flashing and at boot
Flash encryption
XTS-AES-128, unique key per device, key never leaves the chip
Key protection
One-time eFuse burn, JTAG permanently disabled
Electrical and environment
Power
USB 5 V (≥500 mA)
Operating voltage
3.3 V ±5%
Operating temperature
0 – 45 °C
Operating humidity
20 – 80% RH
In the box
TouchPass Basic2 unit×1
Quick-start card×1
TouchPass appDownload from the site
Enclosure 3D print / CNC filesDownload from the site

The store listing is the authoritative packing list.

Where to buy

Currently sold through Taobao and Xiaohongshu — tap through to the store.