Working MVP · Kickstarter in preparation
Multi-factor authentication you can shake hands with.
DapKey is a robotic hand that keeps your two-factor code behind a secret handshake. Perform your dap and it shows a real, standards-based 2FA code that the sites you already use accept. It has already signed into a live account.
Demo code · refreshes every 30 s, just like the real thing
- Real 2FA codesStandard 6-digit codes, new every 30 seconds
- Signed into a live accountProven on real hardware, not a mock-up
- Three factorsThe hand, your handshake, and optionally your face
- Wrong dap? Locked.Longer every time, even through a power cut
Meet the hand
Take the hand for a spin
A simplified 3D model of the DapKey hand. Bend each finger, turn the wrist, strike a pose, or drag the model to look all the way around it.
Drag to look around · tap a finger to bend it
FingersHow far each one bends
WristTurn and tilt
Tilt is model-only. The real wrist turns left and right but doesn't tilt.
Poses
Moves
- Like the real hand: each finger bends on its own, and the wrist turns left and right.
- Model only: the tilt, and the exact shape. The real hand is built from black plates and bolts; the photo at the top shows it.
- Not connected: nothing here talks to a real hand, and posing the model isn't your handshake.
The Signature Collection
Inspired by the greatest moments
Load a handshake inspired by championship nights, opening nights and sold-out arenas, then try to unlock with it. Twenty originals, plus the classic.
Browse all combosInspired by moments, not people. No athlete, team, league, studio, artist or celebrity is affiliated with DapKey or endorses it.
Try it · right here in your browser
Build a handshake. Then prove it's you.
Load a combo from the Signature Collection or build your own, arm it, then do it again from memory. Get it right and a code appears. Get it wrong and it locks, longer every time.
The handshake demo needs JavaScript. Everything else on this page works without it.
Twenty original combos inspired by the big moments in sport, film, music and the red carpet, plus the classic.
Gold 3 moves Platinum 4 Diamond 5–6 Inspired by moments, not people. No athlete, team, league, studio, artist or celebrity is affiliated with DapKey or endorses it.
Tap 3 to 6 moves
Voice catchphrases Concept · not in the device
Your handshake
Two-step verification
Enter the 6-digit code from your authenticator.
A browser demo with made-up codes; nothing you tap leaves this page. The real hand has its own private set of moves, which we don't publish, and you should never film or share your real handshake.
How it works
Three steps. No codes until you show up.
It works with any account that offers "authenticator app" two-factor, which is most of them.
Arm it
A site asks for your two-factor code. Wake the hand and it waits for you. Nothing shows yet.
Do your handshake
Perform your private sequence of moves. The hand judges the whole thing at the end and never says which move was wrong.
Read the code, sign in
The hand shows a fresh 6-digit code on its own display. Type it in and you're through.
The three factors
Have. Know. Are.
No hand, no code
The code is generated on the hand itself and shown on its own display. No separate app is needed to produce it.
Get it wrong, it stays sealed
A private gesture unlocks it. Nothing appears until you perform your handshake, and wrong handshakes lock it down, longer each time.
It knows who's asking
On-board recognition can gate the code to one person, so even the right handshake needs the right human.
Voice layer · concept
Add your catchphrase
An idea from the first sketchbook: say a hype word mid-dap, in between the moves. Today's hand doesn't listen for anything, so this is a concept, not a feature. If it ever ships it would be a bonus on top of the handshake, never the lock on its own, because a word can be overheard or recorded.
Try it in the demoVoice-enhanced combo
Moves + voice · concept
Straight talk
Pick a threat. We'll tell you straight.
Security people ask the hard questions first, so here are our answers, including the ones where DapKey doesn't help.
- Standard 6-digit codes
- Lockouts that escalate
- Setup needs a button hold on the hand
- A published threat model
3 stopped · 2 slowed · 4 not stopped
Someone has your password
They also need the hand and your handshake, and your face if you turn the face check on. That's the same guarantee an authenticator app gives you, made physical.
Someone has your password
They also need the hand and your handshake, and your face if you turn the face check on. That's the same guarantee an authenticator app gives you, made physical.
Push-approval spam
There's no notification to tap "approve" on by accident at 2 a.m. A code only appears after you perform your handshake.
Text-message hijacking
No codes travel by text message, so a swapped SIM card has nothing to catch. Turn off text-message codes on the account too, or they become the weak spot.
Someone takes the hand
They still need your handshake. Wrong handshakes lock it, longer each time, and the count survives a power cut. Someone with tools and time could still read the stored secret out, so treat a stolen hand like a lost phone: use your recovery codes and re-enrol.
Someone watches you do it
A handshake can be copied by watching, the way a PIN can. Do it where no one is looking, pick a longer one, and never film the real one. With the face check on, the right moves also need the right person.
A fake login page
A convincing fake page can pass along any 6-digit code, from any authenticator, while it's still valid. That's why we never call DapKey phishing-resistant. Check the address before you type the code.
Malware on your computer
The production hand never sends the code to the computer it's plugged into, but you still type the code there. Malware that can see your typing can see the code, as with any authenticator.
A thief with lab tools
The stored secret isn't kept in tamper-resistant hardware. With tools and time it could be read out. We say so now rather than later.
Someone forces you
No authenticator can tell when you're being coerced. Neither can this one.
Keep each site's recovery codes. We publish this threat model, and an independent review of the firmware will be linked here before anything ships.
What's new · October 2026
Hardened for launch
The MVP proved the idea. The last few weeks turned it into something you could hand to a stranger.
Locked-down setup
Changing the account, the handshake or the face check takes a physical button hold on the hand, for a short window. Nothing on the computer can change them on its own.
Wrong handshakes cost more each time
A wrong sequence locks the hand, and each failure waits longer than the last: minutes, eventually. The count survives a power cut; a correct handshake clears it.
The code stays on the hand
In the production firmware the code is shown only on the hand's own display and never sent to the computer it's plugged into.
Tested, repeatable builds
Every release is built the same way, checked automatically against the standard before it leaves the bench, and verified on a real unit with a written checklist.
Still ahead before we ship: a battery-backed clock · proving the face check against photos · the printed enclosure · an independent security review
See it, don't read it
Watch the dap unlock a real login
The whole pitch in twenty seconds: perform the handshake, the code appears, the login lands.
Filmed on the actual device. No mock-ups, no CGI, no renders: when the film is here, what you see is what it does.
From the first sketchbook
Two form factors, on the drawing board
DapKey started as a concept in February 2026, and that first sketch had two shapes in it. Today's DapKey is the desk-size robotic hand in the photo. These are sketches: none of them are built, and none are promised.
DapKey Core
Pocket version
- Palm-sized, made to live on a keyring
- The same handshake unlock, shrunk down
- A status light so you know it's waiting for you
- Powered from your computer's port
DapKey Dock
Desk version
- A bigger palm surface for everyday logins
- Lives next to the keyboard, tethered by cable
- Sized for shared offices and front desks
- Room for the face check to sit at eye level
Who it's for
Made for people who like to feel things click
Clever, physical, yours
For the crowd that already runs 2FA and enjoys a device that does something real.
Teach MFA with your hands
A way to show what multi-factor actually means: you can see and feel each factor.
Delight on the daily logins
For the accounts where memorable matters as much as the checkbox.
The dap is the demo
A robot hand giving you a dap is easy to remember and easy to share.
The journey
From a secret handshake to a working 2FA token
The original DapKey idea was a ritual: a dap as a way to prove it's really you. The MVP delivers on that literally.
The secret handshake
A dap as identity. A memorable, human ritual instead of a password you type.
Multi-factor, made physical
Something you have, something you know, and something you are, in one device you hold.
Codes on the device
The hand computes real codes on board and reveals them only after the right gesture.
It logs you in
Proven on real hardware: gesture-gated codes that match a standard authenticator and sign in to a live account.
Built to be trusted
Locked-down setup, lockouts that stick, tested builds. Enclosure and battery clock in progress. Next stop: Kickstarter.
Kickstarter · in preparation
Back the first run
We're preparing a Kickstarter for the first production run. When the pre-launch page is up, this is where you'll find it, and the people who follow it there are the first we'll tell.
What backers will get
- A production DapKey unit, built and tested in Richmond, with its printed enclosure.
- The build log as it happens: real footage, real test results, the misses as well as the hits.
- The honest version of the security story, every time, and the independent review when it lands.
- Firmware updates for the life of the unit.
Follow the build
Three posts a week, real footage only, decoy handshakes always.
Email updates arrive with the pre-launch page. Press: see the press kit.