In one line
DapKey is a robotic hand that unlocks your two-factor code with a secret handshake.
DapKey is multi-factor authentication you can shake hands with. A robotic hand holds one of your online accounts. When you perform your secret handshake on it, the hand computes a real, standards-based two-factor code on the device, shows it on its display, and gives you a thumbs-up; wrong handshakes lock it down, longer each time. It is a genuinely multi-factor TOTP authenticator with a physical, gesture-based unlock, built to be tangible, memorable and human. It is not a hardware security key, and we say so plainly. DapKey is a Hive Mind Security project from Richmond, Virginia.
Fact sheet
| Product | DapKey, a robotic-hand multi-factor authenticator |
| Produces | Standard 6-digit two-factor codes (the same type as an authenticator app) that existing sites accept |
| Factors | Something you have (the hand) · something you know (your handshake) · optionally something you are (on-board face check) |
| Use | Arm it, perform your handshake, read the code off the hand's display, type it in |
| Is not | A phishing-resistant hardware security key. We publish our threat model. |
| Status | Working MVP proven on real hardware; firmware hardened for launch (locked-down setup, lockouts, tested builds); Kickstarter in preparation |
| Where | Richmond, Virginia, USA |
| Maker | Hive Mind Security |
| Contact | press contact: coming with the pre-launch page |
Key messages
- A fist bump can be a second factor.
- DapKey makes multi-factor authentication physical and memorable.
- It is real.
- The codes are standard, computed on the device, and real websites accept them.
- It is honest.
- We say exactly what it protects against and what it does not. No "unphishable", no "world's first".
- It is built in the open.
- Real footage, a public build log, automated tests and reproducible builds, an independent review before shipping.
FAQ
- Is it really two-factor?
- Yes. It produces the same kind of 6-digit code an authenticator app does, so any site that offers "authenticator app" two-factor works with it. The code only appears after your handshake.
- Is it a hardware security key?
- No. Those use a different, phishing-resistant protocol. DapKey is a TOTP authenticator with a physical unlock. A convincing fake login page could still relay a code, which is why we say to keep recovery codes.
- What if someone steals it?
- They still need your handshake (and, if enabled, your face). Wrong handshakes lock the hand for longer each time, and the lockout survives power-cycles. Someone with tools and time could extract the stored secret, so treat theft like a lost phone: use your recovery codes and re-enrol.
- Can someone copy my handshake by watching?
- Possibly, the way a PIN can be shoulder-surfed. Do it where no one is watching, choose a longer handshake, and never film the real one.
- Does it need the internet?
- No. The code is computed on the hand. Setup uses a web page on your computer talking to the hand over USB; nothing is sent anywhere.
- What happened to the voice catchphrases and the pocket version?
- They were ideas from the first concept in February 2026. They're not in the device and not promised; the site keeps them on a clearly labelled concept board.
Photo
The working MVP on the bench in Richmond. Download: JPG, 1500 × 2000. Credit "Hive Mind Security".
Logos
horizontal · light · SVG
horizontal · dark · SVG
mark · SVG
avatar · 1024 · SVGPNG versions: light · dark · mark · link preview. Editorial use with credit "Hive Mind Security"; please do not alter the logo.
Interviews and demos
Interviews, live demos (in Richmond or over video with the hand running) and, when available, review units. The campaign launch date is shared with press two weeks ahead; embargoes honoured.