The Party Trick Demonstration
Choose a demo passphrase — pick one of the two options below
Multi-word phrases give distinct flight and dwell intervals, which makes the rhythm far easier to read. Minimum 10 characters.
2. Add Phantom Keys if you like. Type extra keys and delete them — an extra letter you backspace away, a tap of Esc mid-word. They never reach the passphrase, so the phrase above stays what it is, but they become part of your secret. Do it the same way in all 8 samples.
3. Next, you will hand the laptop to a friend/colleague to try the exact same passphrase — the one you showed them, without the phantoms they never saw.
4. Finally, you type it again to see both scores side-by-side: Same passphrase. Different rhythm.
How CypherKey Works in 3 Steps
Sub-ms Timing & Rhythm Light
Captures key dwell (press-to-release) and flight (release-to-next-press) intervals with microsecond resolution via performance.now(). Client code refuses to capture unless the visible Rhythm Light dot is mounted and rendered.
Client-Side Mathematical Modeling
Computes a normalized feature vector of length 3n + 5. 8 enrollment samples build a statistical profile of means and floored standard deviations (≥ 8ms). Raw events are permanently destroyed.
Dual-Key Server Release
The vault key is split between your client-wrapped key and a server-held secret share. The server releases its share only when passphrase verification and rhythm scoring both succeed.
How It's Safe
Six foundational architectural guarantees from our threat model:
The server stores only Argon2id(authHash) and wrapped ciphertext blobs. The server never sees your master key, wrap key, or plaintext vault.
Stolen passwords leaked from data breaches cannot unlock the vault without replicating the physical timing cadence of your hands.
Raw keystroke events and feature vectors are never stored or logged anywhere. Only irreversible statistical aggregates (means, floored variances) are retained.
No keystroke capture ever occurs without a visible indicator. Code-level enforcement throws an error if the Rhythm Light is missing or obscured.
Graceful degradation ladder: Pass, Grey-band retry, Step-up via passkey/TOTP/Recovery Kit, and Pause mode ensure fatigue or injury never locks you out.
Each device registers an Ed25519 keypair. Every authenticated request signs nonces, timestamps, and payload hashes, preventing replay attacks.
From 2010 at CBS Sports to 2026
In 2010 at CBSSports.com, I built "KeyStroke Captcha" — first to distinguish humans from automated scrapers by how they typed, then pointed it at passwords. I told teammates my password and watched them fail to log in; then I sat down and got in on the first try.
Sixteen years later, the average person manages ~120 passwords, credential abuse accounts for 39% of breaches, and "your password was found on the dark web" has become a routine notification. The timing signal demonstrated in 2010 is present on every login today. CypherKey turns that signal into an effortless, transparent defense.
Milestones & Roadmap
| Milestone | Target Date | Deliverables & Headline | Status |
|---|---|---|---|
| M0 | Sep 14, 2026 | Live browser demo at cypherkey.io, clean repo, zero-knowledge docs, one-pager | Active (Done) |
| M1 | Oct 20, 2026 | Zero-knowledge core (Argon2id, HKDF, AES-GCM), Hono + Drizzle server, docker compose | Scheduled |
| M2 | Dec 05, 2026 | Chrome MV3 extension (WXT), Rhythm Light, domain autofill, 25 private beta users | Scheduled |
| M3 | Jan 20, 2027 | Public launch (HN / Product Hunt), adaptive thresholds, passkey step-up, security audit | Scheduled |
| M4 | Mar 31, 2027 | Stripe billing, breach monitoring, native CLI with terminal raw-mode capture | Scheduled |
| M5 | Jun 30, 2027 | B2B SDK (@cypherkey/sdk) with Progressive Enrollment, Teams tier | Scheduled |
Join the CypherKey Private Beta
Be first to test the Chrome extension and zero-knowledge self-hosted sync engine when Milestone M1 & M2 launch.