Windows 10 · Windows 11 · x64 · Arm64
Fingerprint sign-in for the Windows PC that has no Hello sensor
Windows Hello only works with sensors built into a laptop or a certified keyboard or webcam. immurok is a standalone wireless fingerprint key with its own Credential Provider, so a touch unlocks any desktop PC, and the same key signs your SSH and Git work.
Why a desktop PC has no fingerprint unlock
Windows Hello is Microsoft's framework for biometric sensors, and it only accepts hardware that is built in or certified: a laptop's reader, a Hello-compatible webcam, a handful of keyboards. On a desktop with a mechanical keyboard, the usual answer is a wired USB dongle that does sign-in and nothing else, and needs a free port forever.
What immurok does on Windows
- Lock screen and sign-in. immurok ships a Credential Provider, the same kind of component Windows uses for PIN and Hello. It runs inside the sign-in screen, so a touch unlocks the PC exactly as a Hello sensor would, on any desktop or external keyboard.
- SSH and Git signing. The Windows service includes an SSH agent that signs with the ECDSA key on the device. One toggle takes over the Windows ssh-agent pipe and points Git at the native OpenSSH, and puts both back when you turn it off.
- Password managers. Unlock 1Password, Bitwarden, LastPass or Proton Pass with a dedicated vault password stored on the key, separate from your Windows password.
- TOTP and keys. Two-factor seeds and SSH keys stay on the device and are managed from the desktop client or the command line.
- Firmware updates over the air. The client updates the key over Bluetooth; updates are signed and the key refuses downgrades.
- Two PCs, or a PC and a Mac. The key keeps two independent pairings. Enrol a switch finger and one touch hands it from your desktop to your laptop.
How it works
The client has three parts: a Windows service that talks to the key over Bluetooth LE and holds the encrypted session, a desktop app for pairing, enrolment and settings, and the Credential Provider, a small C++ COM component that LogonUI loads on the sign-in screen. When you touch the key, the service verifies the HMAC-signed match and the Credential Provider submits your credential to Windows. Native installers for x64 and Arm64, Windows 10 and 11. Everything is open source under Apache 2.0 at github.com/immurok/app-win.
Set-up
- Run the installer for your architecture from the download page. It installs the service and registers the Credential Provider; this needs administrator rights.
- Pair the key in Windows Bluetooth settings, then open the immurok app and pair again there. Confirm the encrypted pairing by pressing the button on the underside of the key.
- Enrol a fingerprint and switch on lock-screen unlock.
What it is not
immurok is not a Windows Hello device and does not register with Hello. It does not replace a FIDO security key for signing in to websites, and it does not turn your PC into a passkey. What it removes is the password friction on the machine itself: the lock screen, your vault, your SSH and Git. immurok vs YubiKey explains where the line is.
Common questions
Does it work with Windows Hello?
It does not need Windows Hello. immurok signs you in through its own Credential Provider inside the Windows sign-in screen, so it works on desktops and external keyboards that have no Hello sensor at all. Hello can stay enabled alongside it if your machine has it.
Windows on Arm?
Yes. There is a native Arm64 installer next to the x64 one. Both need Windows 10 or 11.
What happens if the key is not nearby?
Your PIN or password still works. The Credential Provider is one option on the sign-in screen, added next to the ones you already have, not a replacement for them.
Does it use a USB port?
Only to charge. The USB-C port carries no data. Pairing, fingerprint results and everything else go over Bluetooth LE, so the key needs no free port while you work.
Ships December 2026. One-year warranty. No subscription.