Lomenett vs. KeePass and DIY Builds

Lomenett is a $90 password typer you could mostly build yourself, and what the money actually buys is the one part you can't solder, meaning a secure element that destroys the vault key after a handful of wrong PINs. Everything else on this page is us being straight with you about which side of that trade you're on.

First: the DIY path is legitimate, and KeePass is excellent

We're not going to pretend KeePass is the lesser option. It's been open source for two decades, it passed the EU's FOSSA security audit with zero findings, Germany's BSI recommends it, and its database format is trusted by a whole ecosystem, including KeePassXC (independently audited itself), Keepass2Android, KeePassium, and more. It's free, it's local-first, and there's no KeePass server holding millions of vaults waiting to be breached. If your threat model is keeping your passwords out of the cloud and out of the browser, KeePass already does that, for zero dollars.

The hardware side is real too. Search GitHub for Pico password managers and you'll find working projects, meaning RP2040 boards with a small display acting as a USB keyboard that types stored logins. A Pico is a few dollars, CircuitPython makes the HID part almost trivial, and building one is a genuinely great weekend project. If you build one, we sincerely would like to see photos, because this category should exist, and we'd rather more people had offline passwords than fewer, whoever made the device.

Where DIY flatly wins

• Price. A Pico and a display run maybe fifteen dollars, KeePass is free, and we're $90.
• Features. KeePass does file attachments, TOTP via plugins, browser integration, effectively unlimited entries, and custom fields. Lomenett holds 1,000 logins and types them, which is the whole product, so KeePass simply does more.
• Control. Your build does exactly what you told it to, and you know every line, because you wrote it.
• Availability. You can flash a Pico tonight, while Lomenett hasn't opened preorders yet.

The flash dump problem

Here's the part that made us design Lomenett the way we did. An RP2040 has no secure key storage and no meaningful readout protection, so you hold BOOTSEL, plug it in, and the flash mounts like a drive. That gives a DIY typer that encrypts its vault with a PIN-derived key a hard ceiling. Whoever picks up your lost device dumps the flash in thirty seconds and brute-forces the PIN offline, at whatever speed their GPU allows, against a copy, and a 4-digit PIN is only 10,000 guesses, which a computer exhausts instantly. A flash dump gives up everything a PIN-derived key can protect, which is why serious DIY builds fall back to a long master passphrase, and at that point you're entering a long passphrase on two buttons and a rotary encoder every time you want to log in. Most people quietly stop doing that.

Lomenett uses the same class of crypto (AES-128, PIN-derived key) but the key never touches the flash. It lives inside an NXP SE050E secure element and never leaves that chip, so dumping our flash gets you ciphertext and no way to decrypt it. The chip that holds the key counts wrong PIN attempts in hardware and permanently destroys the key after a handful of failures, which is stronger than a lockout because the key stops existing. There's no copy to brute-force, since the secure element can't be cloned. That's the entire reason a short, memorable PIN is safe on Lomenett while the same PIN would be a serious weakness on a bare Pico, and we wrote up the mechanism in detail in why a short PIN is safe here.

Could you add a secure element to your own build? They are certainly purchasable, but getting the trust provisioning, the tamper behavior, and the fail counter right is the part that stops being a weekend project.

The rest of the $90

• The enclosure. Machined aluminum with USB-A on one end and USB-C on the other, working on Windows, macOS, Linux, Chromebooks, and most phones. It's a finished object rather than a breadboard, and we say that with respect, having built plenty of breadboards ourselves.
• The UX. A 128×32 OLED that auto-rotates and a thumbwheel, so you scroll, click, and it types. It has two modes, Inject (types like a keyboard) and Edit (shows up as a flash drive, where you drop a text file of logins in and it encrypts on eject and zeros RAM). Getting passwords onto a DIY device is usually the ugliest part of the project, and Edit mode is our answer to it.
• The battery. Rechargeable LiPo with around 85 days of standby that charges whenever it's plugged in, so you can browse your vault with the stick in your hand and nothing connected.
• The backup story. An encrypted backup file you keep anywhere you like, plus a BIP39 recovery phrase, so if the device dies, you restore, with no account, no server, and no involvement from us.
• Support. Two people in Minnesota who answer email and can't afford to ignore you.
• Auditability. The firmware and the schematics are being released as open source soon, hardware included, so you can build your own from our files if you'd rather, or read ours before trusting it. We think that's the only honest posture for a device like this, and it means choosing Lomenett doesn't mean giving up the thing that made you like KeePass in the first place.

The honest bottom line

If the build is the point, build. You'll learn more from one weekend with a Pico than from anything we sell, and KeePass will serve you well for as long as you care to run it. Buy a Lomenett if you want the threat model of a secure element without provisioning one yourself, or if you're the house sysadmin and the real user is a spouse or a parent who is never going to type a passphrase on a rotary encoder. Plenty of our nerd customers will be buying their second unit for exactly that person.

Related reading: Lomenett vs. letting Chrome save it (the page for that spouse or parent) and Lomenett vs. cloud password managers if your alternative is Bitwarden rather than a soldering iron.