My flagship open-source security project. Turn any mobile device into a hardware-backed authentication token with ECC P-384 cryptography and Bluetooth transport. No cloud dependency. Optional face/fingerprint confirmation on the phone.
MobileProvider turns any Bluetooth phone into a hardware-backed key for your PC. Store a credential once; from then on the desktop can autofill browser logins, sign you into Windows, and lock your session when the phone walks away — with the phone confirming each release by face or fingerprint. The catch that makes it safe: the phone only ever holds an encrypted copy. Your keys never leave the desktop and nothing ever touches the cloud.
The desktop service is the trust anchor: it owns the ECC P-384 keys and an AES-256 master key and performs all encryption and decryption. The phone stores only the sealed blob plus a KeyID and echoes it back on request — it never holds a key or any plaintext.
Cryptographic keys never leave the desktop. The mobile device stores only encrypted blobs + KeyID — no keys, no plaintext.
Per-entry sealed envelopes (IV + tag + ciphertext). DPAPI-protected master key at rest on the desktop.
Direct phone ↔ desktop link on channel 4. No cloud, no internet, no third party in the path.
Optional face or fingerprint on the phone before an already-stored credential is released (WINLOGIN / AUTOLOGIN).
C-compatible DLL / shared library. Same interface on Windows, Linux, and macOS. Powers the Credential Provider and third-party apps.
PING/PONG health over Bluetooth locks or logs off Windows on device loss combined with user inactivity.
Windows service + Credential Provider, Linux daemon (BlueZ/PAM), macOS launchd daemon, Android app, and browser extensions.
All IPC is 4-byte LE length + JSON — framing that prevents injection across pipe, socket, and Bluetooth.
Enterprise-grade credential security without the enterprise baggage — no dedicated hardware to buy and ship, no cloud to trust, and no per-user SaaS bill that grows forever.
A stolen phone or a sniffed link exposes only encrypted blobs. Keys never leave the desktop, so there is nothing to steal on the mobile side.
No YubiKeys or smartcards to purchase, distribute, or replace. Every employee already carries the hardware.
Self-hosted on your own machines. Your secrets never leave your devices and there is no third-party SaaS in the trust path.
Bluetooth-only transport — ideal for air-gapped and high-security environments with no internet dependency.
Browser autofill, Windows sign-in, automatic session lock, and a C API to secure your own apps — from a single paired phone.
Windows service + Credential Provider, Linux daemon, macOS daemon, Android app, and browser extensions — one product, every desk.
Optional face or fingerprint confirmation on the phone before any stored credential is handed back to the PC.
No hardware-token budget, no cloud subscription, low rollout friction — with proven ECC P-384 / AES-256-GCM cryptography under the hood.
Every edition includes the desktop service, mobile app, browser extensions, and SDK. Pick the one that fits, or talk to us about a rollout.
For a single user securing their own PC and phone. Full feature set, one paired device.
Request a licensePer-seat licensing for teams. Central rollout, multiple devices, priority support.
Request a quoteNative SCM service with Bluetooth RFCOMM, named pipe IPC, and Credential Provider integration.
Download .msisystemd service with BlueZ RFCOMM, PAM authentication, logind session management.
Download .deb Download .rpmEncrypted vault with biometric confirmation. API 29+. No key material stored on device.
Download .apkChrome, Firefox, Edge. Native messaging bridge to local service. MV3.
Chrome (.zip) Firefox (.xpi) Edge (.zip)MobileProviderSDK.dll with C API header. Integrate apps with the service.
Download SDK .ziplibmobileprovidersdk.so.1 with header. Available in deb/rpm repositories.
Download dev .deblaunchd daemon with IOBluetooth RFCOMM, os_log, Unix domain socket IPC. macOS 13+.
Download .pkg Install via Homebrewlibmobileprovidersdk.dylib with header. Integrate with any macOS app via C API.
Download SDK .zipIntegrate any application with MobileProvider security infrastructure. C-compatible API, same interface on Windows, Linux, and macOS. Build third-party tools, automate workflows, extend the platform.
| Function | Signature | Description |
|---|---|---|
| IsMobileAvailable | bool IsMobileAvailable() | Returns true if the service pipe/socket can be opened. |
| SayHello | const char* SayHello() | Sends HELLO handshake. Returns service greeting with version info. |
| RequestConnection | const char* RequestConnection(const char* deviceName) | Initiate Bluetooth connection to a named device. |
| DisconnectDevice | const char* DisconnectDevice() | Disconnect the current Bluetooth device. |
| Repair | const char* Repair() | Trigger Bluetooth repair sequence. |
| Function | Signature | Description |
|---|---|---|
| GetMobileStatus | const char* GetMobileStatus() | Returns connection, pairing, and device state as JSON. |
| SetAutoLogout | const char* SetAutoLogout(int action, int intervalMs, int timeoutCount, int btDisconnectEnabled) | Configure auto-logout: action, PING interval and timeout count. |
| SetInactivityConfig | const char* SetInactivityConfig(int enabled, int timeoutSec) | Configure inactivity lock: enable/disable and timeout. |
| SetConfigStorageType | const char* SetConfigStorageType(const char* type) | Switch config backend: "file" or "registry". |
| Function | Signature | Description |
|---|---|---|
| CreateEntry | const char* CreateEntry(const char* key, const char* jsonData) | Create encrypted entry with P-384 + AES-256-GCM. |
| GetEntry | const char* GetEntry(const char* key) | Retrieve and decrypt entry by ID. |
| DeleteEntry | const char* DeleteEntry(const char* key) | Delete entry by ID from both service and mobile. |
| ListEntries | const char* ListEntries() | List all stored entry metadata as JSON array. |
| StoreCredentials | const char* StoreCredentials(const char* username, const char* password) | Validate and store Windows credentials. |
| GenerateCredential | const char* GenerateCredential(const char* requestJson) | Ask the phone to complete a field set (each field prefilled, user-typed, or generated on-device); returns the completed set and stores a sealed copy. |
| FreeString | void FreeString(const char* s) | Securely wipe the per-thread return buffer after copying a secret-bearing reply. |
| Function | Signature | Description |
|---|---|---|
| RequestAutologin | const char* RequestAutologin(const char* key) | Trigger browser autofill with mobile biometric confirmation. |
| RequestWindowsLogin | const char* RequestWindowsLogin() | Trigger Windows login via mobile confirmation. |
| Function | Signature | Description |
|---|---|---|
| ListDevices | const char* ListDevices() | List paired Bluetooth devices. |
| UnpairDevice | const char* UnpairDevice(const char* address) | Unpair specific device by Bluetooth address. |
| UnpairAllDevices | const char* UnpairAllDevices() | Unpair all Bluetooth devices. |
All SDK communication uses 4-byte little-endian length-prefixed JSON. Same format on Windows (named pipe), Linux, and macOS (Unix domain socket).
| Offset | Size | Field | Description |
|---|---|---|---|
| 0 | 4 bytes | Length (LE uint32) | Payload size in bytes |
| 4 | N bytes | JSON payload | UTF-8 encoded JSON message |