Open-source security keys, small enough to wear. A pair is two real keys — one on each ear — so your backup is always on you. Underneath the jewelry it's a real Raspberry Pi RP-Zero, so when you're ready it becomes anything else you can flash.
Same idea, two chips. One keeps your keys in hardware; the other keeps them close and keeps the price down.
Keys held inside the silicon — secure boot, one-time-programmable storage, an isolated core. The one to trust with the accounts you can't afford to lose.
Keys kept in the board's memory behind your PIN. Lovely and real as a second factor, a spare, or a way to learn how passkeys work.
The RP2350 keeps your private keys inside the chip. Secure boot checks the firmware before it runs, a one-time-programmable block holds the secret where software can't read it back, and a separate secure core walls it off from everything else.
In plain terms, this is the one to trust with the accounts you'd hate to lose — email, bank, password manager. It's still open hardware you can audit, not a black box, and Raspberry Pi thought its protection strong enough to put a public bounty on breaking it. Best worn as your everyday primary key.
The RP2040 is the classic, and the friendlier price. Your keys live in the board's memory, locked by the PIN you set rather than sealed in hardware — which makes it a lovely second factor, a spare that rides on your other ear, or the easiest way to learn how passkeys actually work.
Said plainly: someone who steals it and takes it apart could pull the keys out, so don't make it the only thing guarding your most important account. For that one, wear the RP2350. For everything else, it's a real, phishing-resistant key that beats a texted code every time.
Here's the whole thing in plain words. No jargon.
A tiny key that proves it's really you. Instead of typing a code, you touch it and you're in — and there's nothing for a fake site to steal.
Google, Apple, Microsoft, GitHub, Facebook, Amazon, and most sites with two-step login. On a USB-C phone, too.
No app, no battery, nothing to charge or update. Plug it in, touch it, done.
You're wearing your backup. Both ears are full keys, so if one goes missing the other still signs you in. Save your account's backup codes, too.
Turn it on for your inbox first. That's the way back into your other accounts, so protect it first.
It makes a fresh key for every site, so no one can follow you from one to the next.
Your earrings arrive ready to use. This is here for reflashing, for setting your PIN, or if you're building your own from a bare board. No drivers, nothing to install.
Hold the BOOT button, plug the board into USB-C, and it appears as a small USB drive. Drag the LibreKeys .uf2 onto it — it reboots as a security key. That's the whole flash. It works the same on Windows, macOS, Linux, and ChromeOS.
Your PIN protects the key if it's ever lost. The first time you register the key, your browser asks you to create one — nothing extra to do. Want to check it works right now? This runs a real security-key registration in your browser (and asks you to set a PIN if you haven't), then throws the test credential away.
To change or reset a PIN later: your browser's security-key settings (chrome://settings/securityKeys on desktop Chrome) or your OS settings, or use picoforge, LibreKeys' open setup tool.
In an account's security settings, choose Add security key or passkey, then touch the key when it lights. Do the same with its twin — two keys registered means you're never locked out. Start with your email.
| RP2350-Zero · Secure | RP2040-Zero · Everyday | |
|---|---|---|
| Chip | RP2350A | RP2040 |
| Cores | Dual Cortex-M33 + dual RISC-V | Dual Cortex-M0+ |
| Flash | 4 MB | 2 MB |
| Connector | USB-C | USB-C |
| Key storage | In silicon — secure boot, OTP, TrustZone, hardware RNG | In flash, protected by your PIN (no secure element) |
| Standards | FIDO2 / WebAuthn · U2F · passkeys | FIDO2 / WebAuthn · U2F · passkeys |
| Firmware | LibreKeys (open source, AGPLv3) | LibreKeys (open source, AGPLv3) |
| Best for | Your primary, high-value accounts | Second factor, backups, learning |
Honest note: no small open board is a certified secure element. On the RP2040 a determined attacker with the key in hand could extract its secrets, so keep it as a second factor or backup. The RP2350 keeps its keys in hardware and was hardened well enough that Raspberry Pi ran a public prize to break it. Neither is a reason not to use one — any hardware key beats a texted code.
It's a real Waveshare RP-Zero, so it reflashes into all sorts of things. Flashing anything else erases the key — pull it from your accounts first, and reflash LibreKeys to turn it back. Tags show what you need beyond the board itself.
| Project | What it does | You'll also need |
|---|---|---|
| LibreKeys | FIDO2 / passkey security key — what the earrings ship as | Just flash |
| Pico Ducky | BadUSB — types a scripted payload when plugged in | Just flash |
| Light show | Animated color on the onboard pixel — runs on USB power alone | Just flash |
| Credential typer | Types a saved login or one-time string at a button press | Just flash |
| Mouse jiggler | Keeps a computer awake by nudging the cursor | Just flash |
| blueTag | Pocket JTAGulator — finds JTAG/SWD pins on an unknown board | Jumper wires |
| Logic analyzer | 24-channel, 100 Msps signal capture | Free app + wires |
| Scoppy | Two-channel oscilloscope on your phone | Android app |
| Debug probe | CMSIS-DAP SWD debugger + USB-to-serial bridge | 3 wires + OpenOCD |
| pico-crypto-key | USB signing / encryption co-processor | A host program |
| Sub-GHz tool | Scan and replay 315 / 433 / 868 / 915 MHz (an open YardStick) | CC1101 module |
| IR remote | Capture any remote and blast it back | IR LED + sensor |
| NFC / RFID | Read and clone 13.56 MHz badges (MIFARE) | PN532 / RC522 |
| 2.4 GHz scanner | See the 2.4 GHz noise floor — receive only | nRF24 module |
Just flash works with nothing but the board (a laptop or USB power). App / wires flashes alone but needs a free host app or a couple of jumper leads to use. Module is a small solder-or-wire kit. Some of these are security-research tools — use them only on hardware and networks you own.
The open FIDO2 firmware the earrings run. github.com/librekeys
LibreKeys' setup tool — set a PIN, manage or reset the key. github.com/librekeys/picoforge
The upstream project and its docs. picokeys.com
Every Retia firmware, one page. scriptkitty.sh