FAQ

Setup and hardware

Which ESP32-S3 board should I buy? One with native USB, flash of at least 8 MB sustaining QIO at 80 MHz, and a way to reach the serial port: either two USB-C ports, or a UART header plus a USB-serial adapter. The reference board is the N16R8 — neither the 16 MB nor the PSRAM is required, but serial access is: flashing goes over UART, and the 24-word seed is displayed only over serial at first boot. ⚠️ A single-port board with no UART header, Supermini variants included, is not suitable for the beta: you would never see your seed. Buy from AliExpress, Mouser, Farnell, Amazon — anywhere. We do not care where you buy it, and we have no way of knowing.

Does Crypt-in work on Mac? Not yet. The beta is Windows only — the package ships a Windows client and nothing else, and Linux and macOS have no announced date. The .crin format is cross-platform, so files encrypted on Windows will open on a Mac once the client exists.

How long does setup take? About 15 minutes: buy the board, flash the firmware, write down your seed, activate the licence. After that, encrypting a file takes seconds.

Do I need technical knowledge? For the beta, yes — you flash an ESP32-S3 from the command line. The public release will ship a one-click installer.

Seed and recovery

What is the seed and why does it matter? The seed is 24 words that encode your root secret. It works exactly like a cryptocurrency wallet seed: same standard (BIP-39), same mechanism, same responsibility.

Millions of people manage a BIP-39 seed to protect cryptocurrency. The risk is identical, and so is the solution: write it on paper, store it physically, never digitally, never in the cloud. If you can secure a Bitcoin wallet, you can secure Crypt-in.

What happens if I lose my dongle? Buy a new ESP32-S3 (~€5 anywhere), flash the firmware, run the recovery command with your 24 words. The new dongle is cryptographically identical to the old one for file access and all your .crin files open again. One thing does not come back: K_attestation is unique to the physical chip and is never derived from the seed, so the licence server sees a new device — see Recovery.

What if I lose both the dongle and the seed? The data is permanently inaccessible. There is no backdoor and no recovery without the seed. lake8.dev cannot help, because we have never seen it. That is also precisely what stops anyone else from getting in.

Does lake8.dev know my seed? No. It is generated at first boot on your hardware, shown once on serial, and never transmitted. Even if you bought a pre-assembled Kit, the seed did not exist when we shipped it: the factory test ends by erasing NVS, so the keys it generated are destroyed before the dongle is boxed.

Encryption and files

How large can files be? 5 MB per file (MaxEncryptBytes = 5,000,000 bytes — 4.77 MiB), in the current Windows client, which refuses anything larger. That ceiling is the client’s, not the format’s: the .crin container itself reaches roughly 900 MB, as the format spec explains. The limit is there because USB HID moves about 27.8 KB/s, so 5 MB already takes about three minutes. It will be raised in a future update; no date.

Can I encrypt folders? Yes. The Windows client packs the folder into a ZIP and encrypts it as a single .crin file (flag bit 0 set); decrypting restores the folder.

Can I open .crin files on a different computer? Yes, with the dongle. The format is portable: plug the dongle into any computer running the client and your files open normally.

What happens to my files if my licence expires? They stay decryptable forever, as long as you have the dongle — decryption never depends on the licence. When the licence lapses, the app stops encrypting new files the next time it checks the licence online. The dongle has no clock, so expiry is not enforced offline: a machine that never goes online keeps encrypting. We never take your data hostage.

Licence and pricing

Why do I pay €30/year if it works offline? The €30/year covers signed firmware updates, security patches, new features, and the licence server for the initial activation. After activation the dongle works offline forever — if we shut down tomorrow, activated dongles keep working.

Can I transfer my licence to a new dongle? Yes, through the recovery procedure: flash a new ESP32-S3 with your seed, then use the licence transfer in the app. Maximum three transfers per year.

What about the beta licence? Beta licences are free and expire on 31 March 2027 — a fixed date, not a duration from activation. If the beta extends, they are all renewed free of charge. You never pay during the beta — see Developer Beta.

Security

Is the ESP32-S3 a secure element? No. It is commodity hardware with documented hardening — secure boot, flash encryption, eFuse, disabled debug pins. It is not FIPS 140-2 certified and it is not a tamper-resistant HSM. For the declared threat model — device theft, unauthorised access, remote exfiltration — it is adequate. For nation-state physical attacks it is not, and we say so in the threat model.

On production dongles (Kit Standard, Kit Pro — April 2027) Secure Boot v2 and Flash Encryption are active, verified on real hardware: the eFuses are burned at first boot, the dongle runs only firmware signed with the lake8.dev key, JTAG is permanently disabled, and a physical flash dump yields ciphertext.

Developer beta units are the exception. Since 24 August 2026 they run the -dev firmware track with eFuses not burned, which keeps the board reversible but leaves CMD_GET_SECRET (0x04) answering and the flash readable via SPI dump — see the beta page. Anti-rollback is not implemented yet either — see NVS storage security.

None of that turns the chip into a secure element. It raises the cost of a physical attack; it does not move it into a different category.

Has Crypt-in been independently audited? Not yet. An independent protocol audit is planned from Q3 2027, subject to budget; it is not a gate for the April 2027 launch. What exists today is the internal red team report, published in full at /security/red-team-2026-08/. We will publish the independent report too, when it is done.

Where is the source code? The Windows SDK and the Linux CLI are Apache-2.0; the Personal client is GPL-3.0. The Python files in tools/ are internal test harnesses, not a distributable SDK. The host-side source is published as a beta at github.com/jaffa2970/cryptin-sdk-beta since 17 October 2026. Three things do not change with it: the firmware is not in the repository and stays closed source; the beta package is a separate release and ships binaries, not source; and there is no support — the repository takes no issues and no pull requests during the beta.

The firmware is the one closed part, and stays closed: with its source anyone could strip the PIN gate and the licence check. Nothing about it is needed to write a client — the HID protocol and the .crin format are published in full, which is the point.

The firmware is closed source and is not published in any repository. It is distributed as a binary signed with the lake8.dev key on production dongles; the developer beta ships the unsigned -dev build, verified by hash against SHA256SUMS.txt. With its source, anyone could strip the PIN and the licence check and rebuild the product. The SBOM lists the open-source components it is built from, which is a component inventory for CRA compliance — not a source release.

The specifications are a different matter and are public right now: the HID protocol and the .crin format are documented on this site in enough detail to write an independent client, with no agreement and no repository access.

The Windows client is open source under GPL-3.0; the Windows DLL and the Linux CLI are open source under Apache-2.0, and the host-side source is published as a beta at github.com/jaffa2970/cryptin-sdk-beta since 17 October 2026. The Thunderbird plugin follows at launch. The firmware and the licence server stay closed. The Python files in tools/ are an internal test harness and are not distributed as a product — see Python tools. Full breakdown on the licence page.

Why is the SDK Apache 2.0 and the app GPL v3? The SDK is a transport layer other people embed, including in closed-source products: Apache 2.0 permits that and adds a patent grant that protects integrators. The app runs on your files, so GPL v3 keeps it inspectable. GPL v3 rather than v2 because Apache 2.0 is compatible with v3 and not with v2, and the app links the SDK.