Step 1 — Create PIN

On first power-on the device prompts you to create a PIN code. This PIN encrypts the master device key — it is required on every startup.

Step 2 — Connect to WiFi

After PIN creation the device starts an Access Point. Connect to it from your phone or computer. A captive portal opens automatically — select your WiFi network and enter the password. The device reboots after saving.

Step 3 — Web cabinet starts automatically

On first boot after WiFi setup, the web server starts automatically. Enter the device IP or mDNS address in your browser to complete registration.

After entering the PIN on every boot, the device shows a mode selection prompt. Two buttons appear on screen — they represent the two non-default network modes. The third mode (your configured default) starts automatically after a 2-second timeout if no button is pressed.

The default mode on timeout is configurable in Settings → Boot Mode. Factory default is WiFi Client. Each button press resets the timeout by 2 seconds.

WiFi Mode — Web Server

After connecting to WiFi and syncing time via NTP, the device asks: enable web server?

PIN Entry Screen

TOTP / HOTP Screen

Password Manager Screen

The device acts as a hardware keyboard and types the selected password directly — no app required on the receiving device.

T-Display ESP32 (classic): BLE HID only.
T-Display-S3: BLE HID or USB HID. When both buttons are held, a prompt appears on screen to select the output mode. The device pre-selects the configured default — wait for the auto-selection timer, or press a button to switch before transmission begins. USB HID requires no pairing or drivers.

First Connection (Bonding)

1. In the password manager screen, hold both buttons
2. A PIN code appears on the device display
3. On your phone, select the device in Bluetooth settings and enter that PIN
4. Bonding is saved — next time no PIN is needed

Sending a Password

1. Navigate to the desired password using ▲ / ▼
2. The password is transmitted to the phone as keyboard input
3. Press ▲ Top to exit BLE and return to passwords

1. Press RST
2. Immediately after reboot — hold both buttons simultaneously

How to Open

Open the device IP address in your browser, or use the mDNS address: http://t-disp-totp.local (hostname configurable in Settings).

In AP mode a captive portal opens automatically when you connect to the device's WiFi network.

Registration

On first access the device redirects to the registration page. Create a username and password, then log in with the same credentials.

The widget bar is a thin strip at the top of the web cabinet interface. It contains two elements on opposite sides.

Adding a Key

Enter a name and the secret key. Default settings: TOTP, SHA1, 6 digits, 30 second interval.

Click Additional Settings to change:

You can also add a key by uploading a screenshot of its QR code.

Key Actions

Export & Import

1. Click Activate Export and enter your web cabinet password
2. Select the keys to export and click Export — a .enc file downloads
3. To import: activate export again, click Import, upload the .enc file

The .enc file can also be opened in decrypt_export.html (project root) — an offline editor for viewing, decrypting, and editing keys on your computer.

Adding a Password

Enter a name and password. Use the generator icon to create one:

Click Save Password to add it to the list.

Password Categories

Each password can be assigned a category to organise your vault. A category badge appears above the password name in the list.

To assign a category:

• Quick change: click the category badge directly on a password row — a small popup appears, select a new category, it saves immediately.
• Edit modal: open Edit for any password — the category selector appears above the strength indicator. Change and click Save.
• Add form: select a category before clicking Add Password.

Use the category filter bar above the password table to show only entries from a selected category. Click 📋 All to show everything.

Auto-Send (Enter)

When enabled, the device automatically presses Enter after typing the password via BLE or USB HID keyboard. Useful for login forms where the password field is the last input. Enable only when the target application expects Enter to submit — in other contexts it may trigger unintended actions.

The badge ENT appears on the device screen when a password has Auto-Send enabled.

Password Actions

Password Security Badges

While browsing passwords on the device screen, a row of security indicators is shown below the masked password. Badges appear only when relevant — a clean screen means no issues detected.

Export & Import

Works identically to key export — activate, enter password, download .enc file. Compatible with decrypt_export.html.

Device PIN (Startup Encryption)

Controls the PIN requested on every boot. This PIN encrypts the master device key — all stored data depends on it. Enabled by default, created on first boot.

BLE Hardware Confirmation PIN

An additional PIN prompted on the device itself before any BLE password transfer. Prevents unauthorized transfers if someone else has access to the device.

Duress PIN

A separate emergency PIN that triggers an immediate, silent wipe of all device data when entered during startup instead of the normal PIN.

What is erased

When the Duress PIN is entered, the following is permanently destroyed before restart:

• All TOTP / HOTP keys
• All passwords
• Device master key (/device.key)
• WiFi credentials
• BLE bonding data (NVS partition)
• All sessions, web admin credentials, PIN configuration
• The Duress PIN hash itself
• The entire filesystem partition (~3.9 MB) — erased at the hardware level via esp_partition_erase_range, making file recovery impossible even with direct flash access

How to enable

In the web cabinet, open the Pin tab and scroll to the Duress PIN section. Toggle the switch on, enter and confirm the PIN, then click Save Duress PIN. To disable, toggle the switch off — the hash file is removed from the device.

Hidden Space is a second independent encrypted vault. At boot, entering an alternate PIN loads a completely separate set of keys, passwords, and web cabinet account. The device behaves identically from the outside regardless of which space is active.

How it works

The device key file holds two independent encrypted slots. Each slot is protected by its own PIN and salt. The slot that successfully decrypts determines which space loads — the other slot is never touched during that session.

Step 1 — Enable Hidden Space

Open the web cabinet from Space A → Settings → Hidden Space → enable the toggle → confirm. The device restarts.

Step 2 — Set a Space B PIN

On the next boot you are prompted for your main PIN first (Space A unlock), then a new PIN for Space B. The two PINs must be different. After setup the device restarts again and boots normally into Space A.

Entering Space B

At the PIN entry screen, enter the Space B PIN instead of the Space A PIN. The device loads the hidden vault — isolated TOTP keys, passwords, and a fresh web cabinet registration.

WiFi sharing

By default Space B has no WiFi credentials. In Settings → Hidden Space (Space A context), enable Share WiFi with hidden space to let Space B use Space A's WiFi on its first boot. Credentials are re-encrypted with a chip-derived key — neither space can read the other's device key.

Disabling Hidden Space

From Space B: Settings → Hidden Space → disable toggle → confirm. This wipes slot B and deletes all Space B files. Space A data is not affected.

Factory reset and Hidden Space

Factory reset is only available from Space A. A full factory reset wipes both spaces by formatting the filesystem entirely. Factory reset from Space B is blocked.

First boot into Space B

Space B starts empty — no keys, no passwords, no web cabinet account. Register a new web cabinet account on first access. If WiFi sharing is not enabled, configure WiFi credentials in the web cabinet as well.

Change Web Cabinet Password

Requirements: minimum 8 characters, uppercase letter, lowercase letter, number, special character (!@#$%).

Change AP Password

Password for the device's own WiFi access point.

WiFi Network

Change the WiFi network credentials the device connects to in WiFi Client mode. Enter the network SSID (use the Scan button to find available networks), password, and confirm password, then click Save WiFi Credentials.

Bluetooth

BLE device name — maximum 15 characters. This is the name visible when pairing.

mDNS

Hostname for local network access. After saving, the device is reachable at http://<hostname>.local.

Startup Mode

Default screen on boot: TOTP/HOTP view or password manager.

HID Mode

T-Display-S3 only. Default output mode when sending passwords via hardware keyboard emulation: BLE HID or USB HID. This is the pre-selected option shown in the HID prompt — the other mode remains selectable before transmission begins. Factory default: BLE HID.

Boot Mode

Default network mode on boot: WiFi Client, AP Mode, or Offline. The selected mode becomes the timeout default during the boot prompt — the other two modes remain selectable via buttons. Changes take effect on next reboot. Factory default: WiFi Client.

Web Server Auto-Shutdown

Automatically stops the web server after inactivity: 5 min, 10 min, 1 hour, or never.

Auto-Logout Timer

Device Controls