| Login Format
|
Configuration
|
| Site that does not automatically select username field after loading page (i.e.Kracken).
|
With URL - You will notice that "Tab before UserName" is checked. This will select the username field as it is not automatically selected when the page loads.
Without URL - Browse to the login page first and place cursor in the username field before selecting the assigned OnlyKey button.
|
| Site where username is remembered after first login (i.e. Google).
|
Password and 2FA only - This is usually the best option if you remember your username/email address as this will work on any computer whether your username is remembered or not. This method does not include URL in case you are prompted for a password.
Username Remembered w/URL - If you use your device mostly on a computer where you username is remembered this is a good option. If you use this configuration on a computer where username is not remembered then you must output of the login information into notepad and paste into login fields.
|
| Site that does not automatically select OTP code field (i.e. Salesforce)
After loading next page
|
You will notice that "Tab before OTP" is checked. This will select the OTP field as it is not automatically selected when the page loads.
|
| Site where username and password is required first and then OTP code field appears below (i.e. IT Glue)
|
|
## Troubleshooting {#troubleshooting}
### Common Issues {#common-issues}
Below is a list of common issues and solutions.
| Issue
|
Solution
|
| White Light on OnlyKey
|
If full wipe mode is enabled (disabled by default) the OnlyKey will wipe both data and firmware. Follow instructions in the upgrade guide here to load firmware.
|
| Not working with certain sites / Not entering data in correct field
|
We often get customers that ask how to set up a specific site with OnlyKey. There are several examples listed in the table provided in the Set up a slot section. If you have a use case that is not covered by this please open a new issue on the support forum.
|
| Missing characters while typing / typing too fast / typing too slow
|
Adjust the type speed in preferences.
|
| Google Authenticator types NOTSET instead of OTP code
|
This occurs when the OnlyKey does not have the time set. Time is set from the OnlyKey app which occurs automatically. The OnlyKey app must be installed for the code to be generated.
|
| Entering data into OnlyKey App and selecting submit but the data is not saved
|
The check box next to the data must be selected.
|
| Yubicoยฎ OTP Error
|
The majority of Yubikeyยฎ OTP applications require Yubicloud setup including LastPass. See Yubicloud section of User's Guide.
|
If you have an issue not listed here please reference the online support forum [here.](https://forum.onlykey.io)
## Web Links {#web-links}
Documentation - [https://docs.onlykey.io](https://docs.onlykey.io)
FAQs - [/faq](/faq)
Forum -[ https://forum.onlykey.io](https://forum.onlykey.io)
Store โ[ https://onlykey.io/products](https://onlykey.io/products)
Github โ[ https://github.com/trustcrypto](https://github.com/trustcrypto)
Getting started with OnlyKey โ [https://onlykey.io/duo](https://onlykey.io/duo)
---
## [OnlyKey FAQ](https://docs.onlykey.io/faq/)
---
title: OnlyKey FAQ
description: Frequently Asked Questions
slug: faq
last_updated: Oct, 18 2020
keywords: frequently asked questions, FAQ, question and answer
---
## How do I get started with OnlyKey?
Just getting started with OnlyKey? [Start here](https://onlykey.io/start). Just getting started with OnlyKey DUO? [Start here](https://onlykey.io/duo).
## Where do I go for OnlyKey support?
Check out the [OnlyKey Documentation](https://docs.onlykey.io) and if that does not answer your question reach out on the [OnlyKey Support Forum](https://forum.onlykey.io).
## Is OnlyKey Waterproof and Durable?
OnlyKey is protected with a tamper-resistant and chemical-resistant compound that provides:
1. **Durability** - OnlyKey is crush and impact resistant, it stands up to abuse. You can carry it on your keychain, in your pocket, etc.
2. **Waterproof** - Accidentally leave your OnlyKey in your pocket and it goes through the washing machine? No problem.
3. **Tamper-evident / Tamper-resistant** - Attempts by an adversary to access the electronics inside of OnlyKey will create visible damage.
4. **Transparency** - The protective compound is clear so that it is possible to visually verify the electronic components (verify no hardware backdoor).
## How Does OnlyKey Keep My Information From Getting Hacked?
First it is important to understand how accounts are hacked as there are several ways and OnlyKey has unique features that prevent each type.
**1) The site you use is breached (i.e. Yahoo, LinkedIn, Target, Anthem, Sony etc.)**
If the site you use is breached the attacker may be able to get your password in a couple of ways.
a) They get a dump of all passwords in clear text. This is less likely to occur as it usually requires that the service used very bad security practices. If it does occur then it does not matter how long or complex the password is, the password has been compromised.
b) They get a hashed dump of all passwords. If this occurs the attacker has to crack the passwords and only the weak passwords would be compromised.
OnlyKey addresses b) by allowing users to set strong, up to 56 character long passwords which cannot be cracked by any available methods. These strong passwords are also more usable since you don't have to remember them, they are stored on your OnlyKey and typed out for you.
OnlyKey addresses a) by making multi-factor authentication (MFA) compatible with the largest number of sites. If MFA is used and an attacker has your password they still can't access your account as they do not have your second factor.
**2) The computer you use is hacked (you click on a malicious website or download malware accidentally)**
If the computer you use is hacked and you use a cloud based software password manager like LastPass, Dashlane, or even a local password manager like KeePass then the attacker may be able to extract your passwords. As the hacker has access to your computer they essentially have access to everything you have access to on that computer.
If the computer you use is compromised the attacker may be able to get your passwords in a couple of ways.
a) They log all of your keyboard input (Keylogger) or clipboard if using a software password manager.
b) They wait until you unlock your software password manager like LastPass and download the entire database of passwords or access them one-by-one.
OnlyKey addresses b) by storing everything offline (cold storage). Essentially OnlyKey is secure by design so that you can only ever write or wipe passwords stored on the OnlyKey. If an attacker gains access to your computer there are no passwords stored there to steal. Even if your OnlyKey is plugged in and unlocked there is no way to download or copy information from the OnlyKey.
OnlyKey addresses a) by making MFA usable for users and compatible with the largest number of sites. If a MFA method such as TOTP is used then even if an attacker captures your password they still can't access your account without obtaining your one-time password. One time passwords used by Yubikey OTP are only valid once and Google Authenticator TOTPs are only valid once and for a short period of time, usually 30 seconds.
**3) Your cloud based password manager was compromised.**
In this scenario you have chosen the convenience of having passwords accessible anywhere you go with the security trade off being that they are being stored online in the cloud. The provider assures you that the accounts will never be hacked but they missed something and now an attacker has access to every account you own. With OnlyKey you can store your most important accounts offline so that they are never susceptible to this type of attack.
## What if I lose my OnlyKey?
The data stored on OnlyKey is encrypted with military grade encryption (AES-256-GCM) and cannot be extracted from device. Additionally, with a PIN set on OnlyKey that PIN must be known to use the device.
If an attacker tries to guess the PIN it will wipe all data after 10 failed attempts.
What about getting my accounts back? This is where the secure encrypted backup anywhere feature comes in. You can create encrypted backups anywhere by just holding the #1 button down on the OnlyKey. This means that only a physical person can initiate a backup (not malware) and it types out the encrypted file so you can save it anywhere in a local text file, email, etc.
To restore your data if you lose your OnlyKey you can restore this backup to a new OnlyKey or if you like to plan ahead then get a secondary OnlyKey and restore your backup so it is ready in case your primary is lost.
Read more about the technical physical hardware security and encrypted backup feature [here](/security#hardware-security).
## How is OnlyKey Better Than a Smart Card?
Smart Cards are commonly used to provide two-factor authentication and decryption/signing for things like email. Unfortunately, if the computer that a smart card is plugged into is compromised by an attacker then the security of the smart card is compromised. All the attacker has to do is capture the keyboard output (keylogging) and they can capture the users smart card PIN. With this PIN they can then authenticate to anything that the user has access to and also decrypt/sign emails as if the user had done so. With OnlyKey your PIN is entered on the 6 digit keypad located on the device itself that does not in any way send this PIN to the connected computer. In this way the PIN entry is offline and inaccessible to an attacker who has compromised the connected computer.
In addition to on-device PIN security OnlyKey has functionality that smart cards do not like password management, SSH login, GPG agent and is universally supported without the need for drivers to be installed. The OnlyKey is detected by the computer as a keyboard and no middleware or special drivers are required. OnlyKey can be plugged in and used on a computer that you have never used before and it works without installing anything. The OnlyKey app is required to make changes on your OnlyKey and that is available on Windows, Mac OS, and Linux.
## How is OnlyKey Better Than Other Tokens?
There are a variety of hardware and software tokens out there. Some support FIDO U2F and others support Yubikey OTP and yet others support Google Authenticator (TOTP). Unfortunately for users not all websites support all of these. There is no standardization of two-factor support among websites so in order to log in using a token you often need multiple tokens and apps. OnlyKey set out to address this issue and make two-factor authentication usable by supporting the methods most commonly used by websites. Additionally, by combining this with password management we can provide users with a secure login with the touch of a button.
## What specifically are the differences between the Standard Edition firmware and the International Travel Edition firmware?
The International Travel Edition firmware is essentially a feature limited version of the OnlyKey. It is a fully functional password manager but does not utilize encryption and may be usable in countries where encryption is banned/restricted. More information [here](/ite).
## What does entering the self destruct PIN do?
Depending on what your wipe mode is set to it either wipes all sensitive data (erases your usernames, passwords, keys etc.) or if you are using full wipe mode it does a complete erase of the OnlyKey including sensitive data and all firmware (this requires reloading firmware).
Use this PIN when you wish to wipe all sensitive data from the OnlyKey and restore it to a factory default state.
## What apps and services are compatible with OnlyKey?
Our team has created several desktop applications for OnlyKey, see details [here](/#apps). OnlyKey can be used with any application that supports passwords entered via a keyboard which means most applications are supported. Additionally, OnlyKey can be used as a security key for any website or app that supports modern two-factor authentication methods like OATH-TOTP (Google Authenticator), FIDO2 (Security Key), and Yubikey OTP. Finally, you can use OnlyKey for developer tools that are compatible with GPG such as GIT and remote access with SSH. Check out the knowledge base for other use cases [here](/#knowledge-base).
## How is the OnlyKey firmware signed and verified?
The firmware is signed and only signed firmware can be loaded onto device. Additionally, firmware integrity is verified every time the device boots. In the event firmware verification fails the device is wiped and signed firmware must be reloaded. More information available [here](/security#security-features-overview).
## How can I be sure my OnlyKey does not have a backdoor or was not tampered with?
We have designed OnlyKey to be as transparent as possible. The firmware and applications are open source and can be reviewed [here](https://github.com/trustcrypto). Here are some of the features that allow you to validate that there is no backdoor or tampering has occurred.
1. **Hardware** - By having a clear coat on the electronics you can actually see the hardware and would be able to see a hardware type of backdoor.
2. **Open Source** - OnlyKey firmware and apps are published on GitHub and are open to review by the security community.
3. **Decentralized** - Secret keys are generated by you and accessible only to you. Unlike our competitors, we believe in a decentralized model where you have the freedom to control and verify everything on the OnlyKey.
## Is OnlyKey Supported on iPhone, Android, and other mobile devices?
Yes, OnlyKey is supported by any device that would support a USB keyboard. A guide to using OnlyKey with mobile devices is available [here](/mobile).
---
## [OnlyKey Features](https://docs.onlykey.io/features/)
---
title: OnlyKey Features
description: Detailed information on OnlyKey Features
slug: features
last_updated: Dec, 28 2022
keywords: OnlyKey, Features
---
## OnlyKey Product Details
OnlyKey comes in two models:
OnlyKey - Features 6 physical buttons, USB-A interface, and multiple color cases
OnlyKey DUO - Features 3 physical buttons, both USB-C & USB-A interface, and small form factor
### UNIVERSAL SUPPORT
Supports Windows, Mac OS, Android, Linux, and Chrome OS. Driverless operation โ Recognized by computer as a regular keyboard.
### PORTABLE. DURABLE. WATERPROOF
On-the-go โ Easily attach and detach the OnlyKey to your keychain and bring it everywhere you go.
### PIN PROTECTED
For OnlyKey your PIN code must be typed onto the 6 button keypad of the OnlyKey in order to unlock. For OnlyKey DUO you can use the OnlyKey App to unlock. If you lose OnlyKey no problem, it is PIN protected and canโt be used without the PIN, enter the wrong PIN too many times the data will self destruct.
### WHERE CONVENIENCE AND SECURITY MEET
OnlyKey is dual use. It functions as a password manager and a two-factor token. You can plug OnlyKey into any computer, press a button, and it types out a username and password the same as if you typed it yourself; but with one big difference, you donโt have to remember passwords! OnlyKey does that for you. This allows using very complex and secure passwords that cannot be cracked by any available methods.
### SECURE BY DESIGN
Information can only be written to the OnlyKey or wiped. This protects your data even if the connected computer has been compromised. Unlike smartcards that are vulnerable to keylogger attacks, the PIN used to unlock OnlyKey is entered on the OnlyKey itself.
## Key Features
### HARDWARE PASSWORD MANAGER
Instead of having to remember all of your passwords you can just remember one 7 - 10 digit PIN. OnlyKey stores up to 24 unique accounts in offline storage and can be used to secure an unlimited number of accounts if used in conjunction with a software password manager. You can set up each of the 24 accounts using strong and random (up to 56 character) passwords along with the login page URLs, usernames, and/or two-factor authentication. This way whenever you need to log in you just detach the OnlyKey from your keyring and enter your PIN to unlock your passwords. The Onlykey automatically types them into the login fields for you with the press of a button.
### UNIVERSAL 2-FACTOR TOKEN
Supports FIDO2 and FIDO Universal 2nd Factor Authentication (U2F), OATH TOTP, and Yubikeyยฎ compatible OTP. Chances are that if the website supports two-factor authentication, OnlyKey is compatible.
* [FIDO2 and FIDO Universal 2nd Factor Authentication (U2F)](/usersguide#universal-2nd-factor-u2f)
* [OATH TOTP](/usersguide#google-authenticator-totp)
* [Yubicoยฎ One-Time Password](/usersguide#Yubico-one-time-password)
* [Challenge-Response](/usersguide#challenge-response)
### SSH AUTHENTICATION
SSH authentication is easy with passwordless login. Your SSH key remains securely stored in hardware and not available to attackers.
* [OpenSSH Support](/openssh)
* [OnlyKey Agent SSH](/onlykey-agent)
### OPENPGP SUPPORT
Using OnlyKey makes OpenPGP easier than ever.
* [OnlyKey WebCrypt](/webcrypt)
* [OnlyKey Agent GPG](/onlykey-agent)
Keys are loaded using the OnlyKey App. Step by step directions for generating and loading keys are provided in the User's Guide here:
* [Generate keys](/importpgp#generating-keys) using Keybase
* [Load keys](/importpgp#loading-keys) onto OnlyKey
### SELF-DESTRUCT FEATURE {#self-destruct-feature}
In a pinch and want to wipe your OnlyKey? Enter your self-destruct PIN to wipe EVERYTHING! Plus you can always restore from backup easily.
* [What does entering the self destruct PIN do?](/faq#what-does-entering-the-self-destruct-pin-do)
### PLAUSIBLE DENIABILITY FEATURE
The first and only hardware solution where only you hold the keys + no proof there even are keys! Travel abroad without having to give up your encryption keys/passwords.
* [International Travel Edition Guide](/ite)
### ENCRYPTED BACKUP ANYWHERE
OnlyKey types out the encrypted backup so it works anywhere independent of apps. Save the encrypted backup to a file or email it to yourself.
* For information on setting up and using secure encrypted backup see the user's guide [here](/usersguide#secure-encrypted-backup-anywhere)
* For security information on secure encrypted backup see the security page [here](/security#how-backup)
## Other Features
### AUTOMATIC LOCK FEATURE
Want your OnlyKey to automatically lock itself after being inactive for 30 minutes? No problem, this is customizable in [OnlyKey preferences](/usersguide#configurable-inactivity-lockout-period).
### USER SELECTABLE TYPE SPEED FEATURE
Want your OnlyKey to type out information faster or slower? No problem, this is customizable in [OnlyKey preferences](/usersguide#configurable-keyboard-type-speed).
### SYSADMIN MODE
Want your OnlyKey to fill any login form or even automate system administration commands? No problem, enable [Sysadmin Mode](/usersguide#sysadmin-mode).
### ADVANCED HARDWARE SECURITY
Once a PIN has been set on your OnlyKey it locks down the hardware so that even if an attacker gains physical access to your OnlyKey, without the correct PIN it will be useless. Read more about [security architecture of OnlyKey](/security).
### INTERNATIONAL KEYBOARD LAYOUTS
OnlyKey is the world's first device to allow changing your keyboard layout on the fly. Supports multiple international keyboard layouts:
- US_ENGLISH (default)
- CANADIAN_FRENCH
- CANADIAN_MULTILINGUAL
- DANISH
- DANISH_MAC
- FINNISH
- FRENCH
- FRENCH_BELGIAN
- FRENCH_SWISS
- GERMAN
- GERMAN_MAC
- GERMAN_SWISS
- ICELANDIC
- IRISH
- ITALIAN
- NORWEGIAN
- PORTUGUESE
- PORTUGUESE_BRAZILIAN
- SPANISH
- SPANISH_LATIN_AMERICA
- SWEDISH
- TURKISH
- UNITED_KINGDOM
- US_INTERNATIONAL
- CZECH
- SERBIAN_LATIN_ONLY
- HUNGARIAN
- DVORAK
### LED DEFINITIONS {#led-definitions-onlykey-color}
* Steady green light = Unlocked first profile
* Steady blue light = Unlocked second profile
* No light = Locked
* Single yellow flash = Button pressed for PIN entry
* 3 red flashes = Wrong PIN
* Continuous red flashes = Exceeded PIN tries
* Continuous green flashes = Backup and restore is complete.
* Blue blink then green blink = FIDO U2F request
* Blue blink on/off = FIDO2 request
* Purple fade in and fade out - Private key signing request (SSH or PGP)
* Turquoise fade in and fade out - Private key decryption request
* Yellow fade in and fade out - HMAC challenge request
* Red fade in and fade out - Device is in [config mode](/security#config-mode)
* Steady white light - Device is in bootloader mode, use the OnlyKey app to [load firmware](/usersguide#loading-onlykey-firmware).
**ONLYKEY DUO ONLY**
* Steady green light = Unlocked first profile
* Steady blue light = Unlocked second profile
* Steady yellow light = Unlocked third profile
* Steady purple light = Unlocked fourth profile
### Button Definitions {#button-definitions}
#### Unconfigured OnlyKey {#uninitialized-onlykey}
* Hold button #3 down for 5+ seconds to start quick setup - See [OnlyKey Quick Setup](/usersguide#quick-setup) for more information.
* Hold button #1 down for 5+ seconds to start quick setup in manual mode.
* Hold button #2 down for 5+ seconds to start quick setup in auto mode.
#### Locked OnlyKey {#locked-onlykey}
* While locked buttons only function to enter PIN code to unlock OnlyKey, 7-10 digits.
**ONLYKEY DUO ONLY**
* PIN may be entered via OnlyKey App or by physical touch. Touch buttons 1, 2, 3 to enter 1, 2, 3 and hold (for 1 second) buttons 1, 2, 3 to enter 4, 5, 6.
#### Unlocked OnlyKey {#unlocked-onlykey}
* Tap a button for slot