How it works

This document is a high-level overview of ClickStick core components and how they work together.

Core components

The primary use case includes three components: ClickStick dongle, its companion app, and your host machine.

USB dongle

ClickStick dongle is a compact USB stick that contains a ESP32-S3 microcontroller. It includes a Bluetooth Low Energy (BLE) radio, a small display for pairing and configuration, and a button for interaction. You can make it by flashing our open-source firmware onto your own ESP32-S3 dev board (€15 from several suppliers) or buy our official ClickStick dongle (coming soon).

Bring your own hardware

Flash our open-source firmware onto an off-the-shelf ESP32-S3 dev board and run ClickStick on hardware you trust.

Mobile app

The mobile app will be available from the Apple App Store; the Android app will be coming later. The app appears in the iOS Share sheet, so it works with nearly any app. Source code is available for personal non-commercial use, while business deployments shall require a commercial license.

Your host machine

The host machine is any computer, laptop or mobile device that you want to control. ClickStick works with any device that accepts USB keyboards, including:

• Windows, Linux, and Mac computers (made after 1998)
• iPhones and iPads (starting from iOS 13)
• Android phones and tablets (starting from Android 3.1 Honeycomb, 2011)
• Game consoles
• Smart TVs
• …and so on

If the host device does not have a full-size USB-A port, connect the dongle via an adapter (USB-C, micro-USB, or Lightning).

First-time setup

• Bluetooth pairing – The phone discovers the dongle and both devices show the same 6-digit number. You confirm the match on each side.
• App pairing – The dongle displays a QR code, you scan it with the app. This prevents unauthorized apps from controlling the dongle, even from a paired phone.

Daily use

• Insert the dongle into the host machine
• On your phone, select a password and tap Send to ClickStick.
  • If your password manager does not support ClickStick directly: tap any selected text, then choose Share → Send to ClickStick.
• The ClickStick app sends encrypted password to the dongle via Bluetooth
• The dongle types your text into the host computer as if you were pressing real keys.

A brief word on security

The detailed threat model and security requirements are presented in Security, but let's quickly review the key points:

• Only a paired dongle can talk to the app.
• Only a paired app can talk to the dongle.
• The dongle does not keep any transferred data.
• Only the selected password is transferred, other credentials never leave the phone.
• Dongle's flash storage is encrypted with a device-unique key.
• Official dongles will accept only manufacturer-signed firmware. Self-flashed dongles can be configured with your own firmware signing key. Other firmware won't boot.
• BLE connection is encrypted, authenticated, and protected against passive sniffing and active man-in-the-middle attacks. On top of that, ClickStick adds its own encryption layer with out-of-band key exchange and ephemeral session keys.