One touch. Unlocked.
The premium wireless fingerprint key for all.
Screen unlock, sudo, admin prompts, and SSH signing, approved by the finger already on your desk. Built for Mac, Windows, and major Linux distro.
The Kickstarter is live. Early-bird pricing starts at $49.
Problem
Biometrics on modern computers are fragmented, hardware-locked, or missing.
Millions of developers have no fingerprint option at all.
They just type passwords. Every. Single. Time.
So we built the missing piece: a small wireless fingerprint key that handles unlock, sudo/admin, and SSH. On any Mac, any Windows, any Linux.
Everything You Need
Built for Security, Performance and Simplicity.
Screen Unlock
Lock screen → touch → unlocked. Works with Mac mini, clamshell MacBooks, Windows PCs, and Linux.
SSH & Git signing
Push commits signed with your fingerprint. On-device ECDSA private keys.
sudo & PAM
Replace sudo and admin passwords with a fingerprint touch. PAM integration on macOS and Linux, Credential Provider integration on Windows.
A month per charge
~50µA standby current, 1+ month of normal use per USB-C charge. The device sleeps until your finger wakes it.
ECDH + HMAC-SHA256
Secure pairing with P-256 key exchange. Every auth response is cryptographically signed.
Open-source app
macOS, Windows & Linux apps are open source on GitHub (Apache 2.0). Audit it yourself.
One Touch to Approve Your AI Agent
Coding agents want sudo, git push, and your API keys. immurok makes your fingerprint the human-in-the-loop.
$ imk run --agent -- git push origin main
→ waiting for fingerprint…
✓ approved · push proceeding- The overlay shows the verbatim command the agent wants to run. No summaries, no paraphrase.
- One touch approves sudo, SSH signing, and secret reads for that single subprocess.
- Dismiss the overlay and the command is killed. Walk away from the desk and the agent can't act.
- Secrets are injected into the child process only, so they never enter the agent's transcript.
Works with Every Mac, Windows PC & All Major Linux Distros
Linux distributions
Why Immurok
The only standalone wireless fingerprint authenticator for Mac, Windows, and Linux.
| Feature |
Kickstarter early-bird
|
Magic Keyboard Touch ID: $199 | USB dongles Various |
|---|---|---|---|
| Mac mini / Mac Studio |  | |  |
| Clamshell mode | | | |
| Linux support | | | |
| Windows support | | | |
| Wireless | | | |
| SSH Agent | | | |
| sudo / PAM | | macOS only | |
| Standalone (no keyboard) | | | |
| Source-available | | | |
| Price | Revealed at launch | $199 | Various |
Security by Design
Your biometric data never leaves the device. No cloud. No account. No telemetry.
Private keys never leave the device
Fingerprint templates and crypto keys are stored on the device. Nothing is transmitted or stored on your computer.
No cloud. No account. No telemetry.
Zero network calls. Zero analytics. Works entirely offline via Bluetooth, no internet required.
ECDH pairing + signed firmware
ECDH P-256 key exchange for secure pairing. OTA firmware updates are cryptographically verified.
Source code ready for audit
macOS, Windows & Linux apps are open source on GitHub under Apache 2.0. Audit it yourself or have your security team review it.
Tech Specs
Built for engineers, by engineers.
Hardware
| Processor | RISC-V @ 60MHz max |
| Connectivity | Bluetooth LE |
| Fingerprint sensor | Capacitive |
| Standby current | ~50µA |
| Recognition time | <500ms |
| Battery | LiPo 110mAh (USB-C) |
| Battery life | 1+ month typical use |
| Dimensions | 44 × 44 × 14.2 mm |
| Weight | ~40g |
Simple, honest pricing
No subscription. No hidden fees. One device, forever.
- ✓ Fully assembled
- ✓ CNC aluminum body
- ✓ Premium anodized finish
- ✓ macOS, Windows & Linux app included
- ✓ Free firmware updates
- ✓ Priority support
The Kickstarter is live. Early-bird tiers are limited.
For Developers
Source-available, well-documented API. Build your own integrations.
Menu bar app + PAM integration
Service + Credential Provider integration
Daemon + PAM integration
PAM module for sudo & login
Full protocol docs for custom clients
FAQ
Is this Apple's Touch ID?
No, and we won't pretend it is. Touch ID is Apple's closed platform, fused to the Secure Enclave. No third party can plug into it. immurok is an independent fingerprint key: sudo and admin prompts go through PAM (a real system mechanism), and screen unlock uses a separately documented helper path. Same one-touch convenience on the desks Apple left behind, with a different mechanism, honestly documented.
Where do my fingerprints live?
On the device, full stop. Templates are stored and matched on the device itself. What crosses Bluetooth is an HMAC-signed “match succeeded” notification, never the fingerprint. Nothing touches your computer's disk, the network, or any cloud.
What happens if I lose it?
Your fingerprints can't be extracted: templates never leave the hardware, and opening the case trips a tamper switch that wipes the pairing data. Unpair the device from the app and whoever finds it is holding a paperweight. The full threat model is in the security writeup.
Is it open source?
All source code is public on GitHub. The macOS, Windows, and Linux apps — including the PAM modules and the Windows Credential Provider — are open source under Apache 2.0. The firmware and hardware are source-available under BSL 1.1, converting to Apache 2.0 in 2030. You can audit everything, patch it, and build and flash your own unit. The only reserved right until conversion is selling competing hardware with it. We'd rather state that precisely than stretch the term.
Why not just use a YubiKey or passkeys?
Different layer. YubiKeys and passkeys prove who you are to websites (FIDO). immurok removes password friction on the machine in front of you: screen unlock, sudo, SSH signing. It also stores TOTP secrets on-device and releases one-time codes only after a fingerprint touch, so your 2FA seeds never sit in a desktop password manager. They coexist nicely. Many of us use both.
Does it need an account or internet?
No cloud, no account, no telemetry. Pairing is direct ECDH over Bluetooth LE between the device and your machine. Everything works offline, and keeps working even if we disappear tomorrow.
When does it ship?
The Kickstarter campaign is live now. This isn't a concept: the hardware is on its 6th revision, firmware 1.6.0 is shipping with signed OTA updates, and the first pilot batch of 50 units is built and tested. Shipping timeline is on the campaign page.