Hi Arduino Community!
I'd like to share my completed project: SecureGen - a hardware TOTP/HOTP authenticator and password manager built on the ESP32 T-Display and T-Display-S3.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PROJECT OVERVIEW
After getting tired of relying on phone apps for 2FA codes, I decided to build my own hardware security device. The goal was to create something open-source, verifiable, and completely offline.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
HARDWARE
- LILYGO T-Display ESP32 (or S3 version)
- 1.14" ST7789 TFT display (135x240)
- Two physical buttons (navigation)
- Built-in battery charging circuit
- Optional: 3.7V LiPo battery with JST connector
Total cost: ~$15-20
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FEATURES
Core Functionality:
✓ TOTP Authenticator (RFC 6238 compliant)
✓ Password Manager with encrypted storage
✓ BLE HID Keyboard (types passwords wirelessly)
✓ Web management interface
✓ Complete offline operation (air-gapped mode)
✓ Battery powered & portable
✓ USB HID Password Transferring (S3 board-only future)
✓ Supports HOTP and TOTP parameters SHA1, SHA256, SHA512
Security:
✓ AES-256 encryption for data at rest
✓ LE Secure Connections with MITM protection
✓ Hardware-based encryption keys
✓ PIN protection for startup and BLE transmission
✓ 7-layer security for web communications
Display:
✓ Light and Dark themes
✓ Real-time battery monitoring
✓ Visual countdown timers for TOTP
✓ Custom splash screens
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOFTWARE / LIBRARIES
Platform: PlatformIO / Arduino IDE
Language: C++
Key Libraries:
- TFT_eSPI (display)
- ESPAsyncWebServer (web interface)
- ArduinoJson (data handling)
- mbedTLS (encryption - built into ESP-IDF)
- ESP32 BLE Arduino (Bluetooth)
The code uses hardware-accelerated AES on the ESP32 for encryption operations.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TECHNICAL CHALLENGES & SOLUTIONS
- Memory Management (BLE + WiFi):
The ESP32's BLE stack uses ~70KB of RAM. Running BLE and WiFi simultaneously causes heap fragmentation and crashes.
Solution: Strict mode separation - TOTP mode uses WiFi only for NTP sync, then disables it. Password manager runs pure offline with BLE only active during transmission.
- BLE Security (iOS Compatibility):
iOS enforces stricter bonding requirements than Android. Standard BLE configuration would pair with Android but fail silently on iOS.
Solution: Adaptive bonding parameters that detect device type and adjust security keys (CSR key required for iOS).
- Keyboard Layout Mapping:
Different keyboard layouts handle special characters differently (@ is Shift+2 on US layout, but Shift+' on UK).
Solution: Configurable layout system with user-selectable mappings in the web interface.
- Display After Deep Sleep:
TFT_eSPI library had GPIO state issues causing the ST7789 display to fail initialization after deep sleep.
Solution: Full hardware reset sequence with specific timing delays before re-initializing the display driver.
- Flash Wear Leveling:
ESP32's NVS has limited write cycles. Frequent password updates could wear out flash memory.
Solution: Additional wear leveling layer on top of standard NVS, plus RAM buffering to reduce write frequency.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PHOTOS / VIDEO
[Insert your device photos here]
Demo video (2 minutes): https://youtube.com/watch?v=YTVQBwgok_E
Shows TOTP generation, password management, BLE keyboard typing, and web interface in action.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RESOURCES
GitHub Repository (full source code):
Hackster.io Project (detailed build guide):
SecureGen - Open-Source TOTP Authenticator, Password Manager - Hackster.io
Wanna flash? (Chrome Browser Support)
Technical Blog Posts:
- Memory management challenges (BLE + WiFi on ESP32)
- Implementing LE Secure Connections
- makepkg - DEV Community
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BUILD INSTRUCTIONS
- Clone repository
- Open in PlatformIO (or Arduino IDE with ESP32 board support)
- Connect T-Display via USB-C
- Upload firmware
- Configure WiFi and set master password
- Ready to use!
Pre-compiled binaries available for those who just want to flash and go.
Detailed documentation and troubleshooting guide in the GitHub repository.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
USE CASES
- Privacy-conscious users wanting verifiable 2FA
- Self-hosters building their own infrastructure
- Teams needing shared secure password access
- Offline/air-gapped environments
- Anyone who wants to audit their security code
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FUTURE IMPROVEMENTS
Currently planning:
- U2F/FIDO2 support for hardware security keys
- Encrypted SD card backup
- Multi-device sync via encrypted protocol
- Custom mechanical enclosure designs
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
QUESTIONS / DISCUSSION
I'm happy to answer questions about:
- ESP32 development and optimization
- BLE security implementation
- Encryption and key management
- Power optimization techniques
- Hardware selection and assembly
What security features would you prioritize in a hardware device like this?
Any suggestions for improvements or additional features?
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
LICENSE
MIT License - completely free and open source.
Feel free to use, modify, and distribute!
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
If you build one, I'd love to see it! Share your builds and any modifications you make.
Thanks for checking out the project! 