tinyTouch
Your fingerprint.
Not your password.
Touch the sensor. Your Mac unlocks, sudo clears, the Keychain opens. No $149 keyboard required.
From $49.00 · assembled and flashed
Buy tinyTouch
Requires a Mac and a free USB port. Read the security notes below — this is a convenience device, not a secure element.
How it works
Plug in. Touch. You’re in.
01
It’s a keyboard
tinyTouch enumerates as a native USB HID keyboard. No drivers, no kernel extensions, no accessibility permissions. macOS just sees typing.
02
Your password stays put
The password lives in the macOS Keychain and never touches the device. tinyTouch stores only a 32-byte pairing key.
03
Every match is challenged
Nonce-based request, MAC verification, AES-CTR session encryption, then the buffer is wiped. Replays are rejected.
Under the hood
What happens on a match
The device generates a nonce
A fresh random value for this request only.
It sends an authenticated request
The macOS helper checks the MAC and rejects anything replayed.
The helper encrypts your password
AES-CTR, using a session key derived from the pairing key and that nonce.
The device types it, then forgets it
Decrypted in RAM, typed over HID, buffer wiped immediately.
Read this part
We’d rather you know.
tinyTouch trades some security for convenience, and we’re not going to bury that in a footnote.
What an attacker can do
Anyone holding both the paired device and your unlocked Mac can request the password on a fingerprint match. A spoofed UART connection to the device can do the same thing. The two halves are only secure when they’re apart — so keep them apart.
There is no secure enclave here and no hardware attestation. If your threat model needs that, buy a Touch ID keyboard or a smart card instead. A smart-card-compatible version is in the works.
Specifications
What’s inside
| Microcontroller | ESP32-S3 Mini — native USB HID, hardware UART |
|---|---|
| Fingerprint sensor | ZW101 optical module, 0xEF01 packet protocol |
| Enclosure | Two-piece 3D-printed case |
| Connection | USB-C, standard UART wiring with interrupt-driven finger detect |
| Crypto | 32-byte pairing key, AES-CTR session encryption, nonce replay protection |
| Requires | macOS, Python 3 for one-time helper setup, a free USB port |
| In the box | Assembled unit |
| License | Open source — firmware, helper, STLs, and CAD are public |
Questions
Before you buy
Does this work on Windows or Linux?
Not today. The helper is macOS-only — it depends on the Keychain and runs as a launchd agent.
How hard is setup?
About ten minutes. You generate a pairing key, store it and your password in the Keychain via the included helper, and load the launchd agent. Full instructions live in the repo.
Can I just build it myself?
Yes, and you should if you enjoy that. Everything is open source — firmware, macOS helper, enclosure STLs, and CAD are all at github.com/ZimengXiong/tinyTouch. This exists for people who’d rather not source an ESP32-S3 Mini and a ZW101, solder them together, and print a case.
Is my fingerprint stored anywhere?
The template stays on the sensor module. It never reaches your Mac and never leaves the device.
What if I change my password?
Re-run the helper with the new password. No reflashing, no re-pairing.