Why build your own hardware security tools?
Building your own ESP32 fingerprint lock and offline password vault means using small microcontroller boards to handle biometric authentication, local encryption, and password entry directly in hardware so that your credentials stay offline, under your control, and independent of cloud services or third‑party password platforms.
If you are comfortable plugging in a development board and flashing firmware, you can build DIY biometric security that feels surprisingly polished. An ESP32-based fingerprint scanner can unlock a PC or help with passkeys, without storing the password on the device itself. A tiny keychain unit can act as a hardware password manager, generating and typing strong passwords over Bluetooth instead of relying on a browser plugin.
These projects are not meant to guard state secrets. The fingerprint system, for example, can still be attacked if someone has both your PC and the device and tampers with its UART lines. The value is practical: you reduce exposure to phishing pages and cloud breaches, and you learn how microcontroller encryption works by seeing it in your own hands.
Project 1: ESP32 fingerprint lock with local control
The first project is an ESP32 fingerprint lock that behaves like a passwordless login key for your computer. An ESP32S3-based board such as a Seeduino XIAO talks to a fingerprint sensor, then opens both a USB HID keyboard channel and a serial link to your laptop. When you touch the sensor and it recognizes you, the device asks your laptop for an encrypted password using its public key, receives the ciphertext, decrypts it, types it via HID, and clears it from memory within milliseconds. That workflow keeps the password off long‑term storage and away from the network while still giving you a smooth login flow.
- Gather the ESP32S3 board, compatible fingerprint sensor, USB cable, and a computer with the Arduino or ESP-IDF toolchain installed.
- Clone the community fingerprint lock firmware from its public code repository, and open the project in your development environment.
- Configure the project for your specific ESP32S3 board and USB HID settings, then build and flash the firmware to the device.
- Connect the ESP32 fingerprint unit to your PC, enroll one or more fingerprints via the provided serial or configuration interface, and confirm the sensor matches them reliably.
- Set up your PC so the ESP32 HID keyboard can type your login or passkey response, then test that a successful fingerprint scan requests the encrypted password and enters it for you.
- Once the flow works, harden the hardware: mount the sensor securely, consider potting or epoxy over exposed UART pins, and keep the device physically with you to reduce tampering risk.
The clever part is that the password is never stored on the fingerprint device; it only exists in RAM for a tiny window while being decrypted and typed. This makes the ESP32 fingerprint lock a neat example of microcontroller encryption in practice. The main gotcha is physical security: if an attacker grabs both your laptop and the device, they might spoof the fingerprint sensor over UART, which is why some makers cover those pins in black epoxy. Treat this as a strong convenience upgrade for home or personal use, but still lock your computer and do not treat the gadget as an unbreakable token.
Project 2: Keychain hardware password manager on M5StickC PLUS2
The second build is a hardware password manager in keychain form, based on an M5StickC PLUS2. This compact ESP32 device includes a screen, buttons, battery, and Bluetooth LE, which makes it ideal for a portable offline password vault. Its firmware creates a "M5 Vault" Bluetooth keyboard profile, asks for a PIN on boot, and then lets you pick from a list of services stored in onboard non‑volatile preferences memory. When you select one, it computes a stateless password, for example using a SHA‑256 based derivation routine, and injects that password over BLE as if you were typing it.
Configuration is handled locally. Entering a special PIN value moves the device into a Wi‑Fi configuration portal mode, where you can edit the list of service names stored under a key such as "apps" in NVRAM preferences. Normal unlock with a different PIN instead derives a master key string for password generation and enters "VAULT_MODE" with an auto‑lock timer. The firmware uses microcontroller encryption libraries such as mbedtls with SHA‑256 to ensure that the generated passwords are based on secure hashes rather than weak custom schemes. Because all logic runs on the device and it behaves only as a BLE keyboard, your password vault remains offline and far from cloud sync risks.
This design is closer to a classic offline password vault than a synced manager: nothing needs to be stored in plain text, and passwords are derived on demand from your PIN and the selected service. It helps to think of the M5StickC PLUS2 as a small, single‑purpose computer that knows how to generate long random‑looking strings and type them. The main gotcha is the PIN itself: treating a short code as your master key means you should protect the device physically and keep auto‑lock enabled so someone cannot pick it up unlocked and spam passwords into their own machine.
Offline, user‑controlled security and community firmware
Both of these builds share a theme: hardware-based security that keeps sensitive credentials offline and under your control. In the fingerprint lock, the password comes from your laptop only as an encrypted blob, is decrypted in RAM for milliseconds, and is never stored on the device itself. In the keychain vault, service names live in local preferences storage and passwords are computed when needed, not saved as a clear-text database. In both cases, the microcontroller is doing the encryption or hashing work, whether that is public-key encryption for the PC password exchange or SHA‑256 based derivation for stateless passwords.
Another advantage is transparency. The fingerprint lock originated from a hobbyist sharing their ESP32-powered fingerprint scanner code with the community, and the password vault firmware is written using common open libraries such as BleKeyboard, Preferences, and mbedtls on an M5StickC PLUS2. That means you can read the source, change defaults like auto‑lock timing, or even replace the password generation logic if you have specific threat models in mind. You are not locked to a vendor’s closed implementation, and you can apply the same ideas to doors, safes, or any other DIY biometric security project you dream up.
In the end, building an ESP32 fingerprint lock and a hardware password manager is worth it if you want to learn how microcontroller encryption works and gain more offline control of your logins. You will still need good basic hygiene—strong PC account security, backups of your master secrets, and physical care of the devices—but you get a satisfying blend of convenience and privacy that feels more like owning the keys to your digital life than renting them.
