What you need
- An ESP32-S3 board (~€5 — buy it anywhere)
- A USB-C cable
- Windows 11 or later, 64-bit — the beta package is a Windows package
- Linux / macOS — not yet. The Linux CLI is part of the SDK, and the SDK is not in this download
- 15 minutes to flash and activate
We do not ship hardware during the beta. You source the ESP32-S3 yourself. That is intentional — the whole point is that a commodity chip, with the requirements above, becomes a Crypt-in dongle.
Hardware of the beta
Beta dongles run the -dev firmware track. Unlike production dongles, eFuses are not burned: Secure Boot v2 and Flash Encryption are not activated on beta hardware.
This means two things, and we would rather say them first.
The beta dongle is fully reversible. If you decide not to continue, flash any other firmware and the board goes back to being a standard ESP32-S3.
It also means less protection, not just fewer constraints. On -dev the flash is in the clear, so the seed can be pulled with an SPI dump, and the dongle answers CMD_GET_SECRET (0x04) after the PIN: it returns the dongle's file_secret, from which the key of every file that dongle has encrypted can be derived — the per-file salt is in the clear in the header. A beta dongle protects your files from a stolen laptop, not from someone who has the dongle in hand. Do not put data on a beta dongle that you would not want readable by someone with physical access and an SPI flash reader. What carries over to the shipped product and what does not is spelled out in the flash guide and the security model.
On expiry — the honest version. The beta programme ends on 31 March 2027, and beta licences are dated to that day — a fixed date, not a duration from activation. If the beta continues past it, every beta licence is renewed free of charge, through the standard renewal process. But the dongle has no clock: a beta dongle you have already set up keeps decrypting your existing files offline even after that date. You never lose access to what you have encrypted. What ends on our side is the ability to activate or transfer a beta licence.
Production dongles (Kit Standard, Kit Pro — April 2027) will have eFuses burned at first boot, Secure Boot v2 and Flash Encryption active, exactly as described in the security model.
Hardware that works
Not any ESP32-S3 board will do. You need native USB, flash of at least 8 MB sustaining QIO at 80 MHz, anda way to reach the serial port — two USB-C ports, or a UART header plus a USB-serial adapter: flashing goes over UART, and the 24-word seed is shown only over serial at first boot — on a single-port board you would never see it. Reference board:N16R8, though neither the 16 MB nor the PSRAM is required. This is what we develop and test on, and where it ends up.
When in doubt, buy the ESP32-S3-WROOM-1 DevKitC-1: it is the board this beta is developed against. On a board with two USB-C ports the two arenot interchangeable — the HID device appears only on the native OTG port (VID_303A&PID_8123), while the CH343 bridge (VID_1A86) is a plain serial port, and is where the dongle prints your 24 words at first boot. A board with both ports is the easier path: see the flash guide.
