SHIBkeystick
Pre-order
SHIBkeystick
Pre-order
Level 2 · the environment
The most important thing about your key’s birthplace is that it stops existing. Here is exactly how — and what “destroyed” really means on physical hardware.
When you restart from the stick, your machine never loads its own operating system. Instead it loads ours: a minimal, purpose-built system that runs entirely in RAM. Three properties are enforced by construction, not by promises.
Your hard drive is never mounted. There is nothing to accidentally write to, cache on, or swap into. The environment physically cannot leave notes for later.
The generation path contains no networking capability at all — not “we don’t call home”, but “the code that could is not present.” Nothing can be transmitted, because there is nothing to transmit with.
No logs, no telemetry, no analytics, no crash reports, no clipboard. Anything written anywhere must be assumed permanent and public — so nothing is written, anywhere, ever.
RAM is volatile — it needs constant power to hold anything. Cut the power and its contents decay to noise within moments. Because the entire environment (operating system, generator, and your key) lived only in RAM, the power cord is the shredder. You don’t have to trust a “secure erase” claim; you perform the destruction yourself, physically, and you can see it happen.
We’d rather over-explain than over-promise.
Memory contents can persist for a short window after power-off, and exotic attacks — freezing the RAM chips within moments of shutdown — can extend it. If someone with liquid nitrogen is physically at your machine the instant you power down, you have bigger problems. But the attack exists, and now you know its name.
A networked printer stores what it prints. That is why the ceremony insists on a pen.
A photo of your screen syncs to a cloud. The ceremony reminds you before showing the phrase.
Malware in the computer’s deepest chips, below any operating system, is not defeated by booting from a stick. It is nation-state-tier rare. If it is genuinely in your threat model, use a dedicated cheap machine that has never been online — an inexpensive used laptop makes a superb ceremony computer.
Apple Silicon Macs cannot boot external systems, so the for Mac editions run the ceremony in a sealed, network-less sandbox inside macOS. It is a real, hardened isolation — but macOS keeps running underneath, so destruction there is a strong claim rather than physics.
Bootable editions: your computer becomes the vault, then ceases to exist. Mac editions: a sealed room inside your Mac. We will never blur the two. If the difference matters for the amounts you’re protecting, run the bootable ceremony on any PC.
If the tool refuses
If the environment isn’t what the appliance expects — randomness source missing, integrity check failed — it stops and tells you in plain words what failed and what to do next. A refusal is the product working, not failing. It will never quietly degrade and let you generate anyway.