Skip to main content
ZeroKeyUSB is primarily a hardware password manager, but it exposes a minimal serial interface for automation, backups, and diagnostics. This reference summarizes the available commands and their expected responses.

​
Connection details

  • Interface: USB CDC ACM (appears as /dev/ttyACM* on Linux/macOS, COM port on Windows)
  • Baud rate: 115200
  • Line endings: \n (LF)
  • Authentication: Device must be unlocked with the Master PIN
All commands are ASCII text. Responses end with \n as well.

​
Command list

CommandDirectionDescription
PINGHost → DeviceReturns OK. Use to verify the connection.
STATUSHost → DeviceDevice replies with key-value pairs (firmware version, slots used, clock drift).
EXPORTHost → DeviceStreams credentials as CSV lines until EOF. Requires confirmation on the device.
IMPORTHost → DevicePuts device in import mode; host must send CSV rows followed by an empty line.
SETTIME <epoch>Host → DeviceSets the Unix epoch for TOTP. Must be sent in seconds.
REQTIMEDevice → HostDevice requests the current epoch; respond with SETTIME.
FACTORY_RESETHost → DeviceArms a wipe. User must hold the center touch pad for 5 seconds to confirm.
TOUCHSTATUSHost → DeviceReturns raw capacitive sensor values for diagnostics.
Unrecognized commands return ERR without altering device state.

​
Session example

$ screen /dev/ttyACM0 115200
PING
OK
STATUS
FW=1.2.0
SLOTS_USED=18
CLOCK_DRIFT=+12s
IMPORT
# send CSV rows here
Use the host CLI (zerokeyusb-cli) to automate these exchanges safely.

​
Error handling

  • ERR LOCKED – Device is still locked; enter the Master PIN.
  • ERR BUSY – Another operation is in progress (e.g., export); retry later.
  • ERR FORMAT – Command arguments are invalid (wrong epoch format, malformed CSV).
The device never sends credentials over serial unless explicitly instructed and confirmed on-device.
⌘I