T-Display ESP32 & S3 — Dual Board Showcase
ESP32 (left) running TOTP authenticator · S3 (right) running password manager with larger 1.9" display

TOTP Mode (Dark Theme) Real-time authentication codes	TOTP Mode (Light Theme) Customizable display themes	HOTP Mode (Light Theme) Counter-based authentication
Password Manager Mode Secure offline password vault	T-Display-S3 Close-up 1.9" display, USB HID support	QR Code Export Export keys directly from display

Hardware Comparison ESP32 (1.14") vs S3 (1.9")	Battery & Status Real-time monitoring	BLE Security Mode Encrypted wireless transmission
Boot Mode Selection WiFi / AP / Offline at startup	Factory Reset Secure data wiping

Dashboard Secure web access	TOTP Management QR code scanning & bulk import	Password Vault Encrypted storage & search
Security Settings PIN & authentication config	Device Configuration Network & display settings	Password Generator Advanced generation & statistics

Watch the full demonstration — TOTP generation, password management, BLE keyboard, and web interface.

▶️ Watch on YouTube

• Compatible with Google Authenticator, Microsoft Authenticator, Authy, and all RFC 6238 / RFC 4226 services
• SHA1 / SHA256 / SHA512, 6 and 8 digit codes, 30s and 60s periods
• HOTP counter-based codes with automatic counter increment
• Add keys via QR code scan (camera or file), manual entry, or bulk import (via Secure Import/Export Mode)
• Export any key as QR code — displayed on the device screen and in the web interface
• Encrypted storage with unique per-device key

• Offline encrypted vault — works without any network connection
• BLE HID keyboard (ESP32 & S3): types passwords directly into any device, no clipboard
• USB HID keyboard (S3 only): native USB connection, no pairing needed
• PIN protection for BLE transmission
• Wildcard passwords: randomly generated on-device passwords that never leave the device — ideal for accounts where you only need HID typing, not clipboard access
• Encrypted export/import for backup and migration

• Two independent vaults — alternate PIN at boot unlocks a fully isolated second space with its own TOTP keys, passwords, and web cabinet account
• Optional WiFi sharing — Space B can inherit Space A WiFi credentials with one toggle; disabled by default
• Full isolation — separate BLE PIN, web admin credentials, and session per space; spaces cannot read each other's data

• Runs on the device itself — no cloud, no external servers
• Full TOTP and password management from any browser
• Password generator with complexity settings
• Three network modes: WiFi client, AP hotspot, or fully offline
• Multilingual interface — English, Russian, German, Chinese (Simplified), and Spanish

• Light and dark themes, switchable from the web interface
• Custom splash screens on boot
• Battery indicator and WiFi status always visible

Supported Boards:

• T-Display ESP32 — dual-core 240MHz, 1.14" SPI display (135×240), BLE HID keyboard
• T-Display-S3 — dual-core 240MHz, 1.9" parallel display (170×320), 8MB PSRAM, USB HID + BLE HID keyboard support

Features:

• Battery monitoring with real-time voltage and percentage
• Deep sleep and light sleep power saving
• DS3231 RTC module support — accurate offline timekeeping without WiFi; enables TOTP in AP and Offline modes
• USB HID on S3 — type passwords via native USB connection (no BLE pairing needed), better performance with AES encryption

All sensitive data is encrypted with AES-256 using a unique per-device key derived from your PIN via PBKDF2-HMAC-SHA256. The web interface runs over an HTTPS-like encrypted channel (ECDH P-256 key exchange + AES-256-GCM) — works even in AP mode without certificates.

8 layers of web protection: key exchange → session encryption → URL obfuscation → header obfuscation → decoy traffic → method tunneling → timing protection → honeypot endpoints.

Device security: PIN with persistent lockout (5 attempts across reboots), secure memory wipe before deep sleep, encrypted BLE pairing.

Hidden Space: two-slot device key file; Space B unlocked only by its own PIN via independent PBKDF2 derivation; wipe zeroes slot and deletes all HMAC-derived files.

• PBKDF2 iteration count (25,000) is below OWASP 2023 recommendations due to ESP32 hardware constraints
• No hardware secure enclave or secure boot by default
• Active MITM on initial ECDH exchange is not detectable without a server certificate

→ Security Overview — full security summary
→ Security Model — technical reference for developers and auditors

Wake from sleep: press Button 2.

• PlatformIO (VS Code extension)
• LILYGO® TTGO T-Display ESP32 or T-Display-S3
• USB-C cable

→ Web Flasher — Chrome/Edge + USB, no install needed
→ User Guide
→ Decrypt Export Tool

git clone https://github.com/makepkg/SecureGen.git
cd SecureGen

# Open in VS Code with PlatformIO extension

# For T-Display ESP32:
pio run -e lilygo-t-display -t upload

# For T-Display-S3:
pio run -e lilygo-t-display-s3 -t upload

1. Device creates AP ESP32-TOTP-Setup → connect and open 192.168.4.1
2. Enter WiFi credentials
3. Set administrator password and optional PIN
4. Device syncs time via NTP and is ready

→ Complete User Manual for detailed setup and usage

🔌 Want to run SecureGen on your own hardware?
See the Hardware Porting Guide — hardware requirements, step-by-step board setup, and which #ifdef to touch.

• Quick search by favorites / pinned accounts
• Display settings in web interface (brightness)

• Flash encryption and secure boot (optional hardening)
• ATECC608 secure element support
• SD Card Module Support for pin code + cryptokey unlock feature
• ZW111 Fingerprint module support
• Add support extra keyboard layouts for BLE send

• Migration ECDH P-256 → X25519 (~400ms → ~80ms key exchange)

Here are some awesome reviews and community projects featuring this ESP32 device:

• Video Review by Linuxndroid — A detailed look into the hardware setup and features.
• Step-to-Step Guide by Linuxndroid — A detailed look into the hardware setup and features.

• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Instagram: securegen — Official device account (photos, hardware updates, and community highlights)
• YouTube: Demo & Tutorials
• Dev.to: Technical Articles
• Twitter/X: @makepkg
• Hackster.io: Featured Project
• Product Hunt: Launch Page

USDT BEP-20: 0xd03499C9c6100Af624603b4D6fb185A65694745C

USDT TRC-20: TUAzeSrKeDYbt6HCs9PL6q1t5amHHdnnwR

USDT SOLANA: 2cecCCh8pzUNmEpjLQ3aa9sfPL5KXqANrmSfiiDWubCj

⭐ Star this repo if you find it useful!

MIT — see LICENSE. Third-party: TFT_eSPI (FreeBSD), ESPAsyncWebServer (LGPL-3.0), AsyncTCP (LGPL-3.0), ArduinoJson (MIT), mbedTLS (Apache 2.0).