A FIDO2 key fits on a keyring. The questions around it take a little more space. Is it genuine? Are there known vulnerabilities? Which accounts depend on it? And what happens if it goes missing?
That is where KeyMelier comes in. It is a free desktop app for macOS, Windows and Linux that checks security keys across vendors and connects technical checks with a practical inventory of your keys.
The PIN dialogue is only the beginning.
A browser can set a PIN or delete a stored passkey. Things get more interesting when several keys, different manufacturers and different uses enter the picture.
KeyMelier shows the model, supported features and metadata. It checks attestation evidence and compares the key against a curated, signed database of known vulnerabilities. Findings are summarised per key, with guidance on concrete next steps.
A check without findings is not a security guarantee. Missing evidence remains missing evidence. The database of known vulnerabilities is not exhaustive.
What is on which key?
The inventory remembers keys it has seen and their last known contents. This helps identify stored accounts that appear on only one key. If a key is lost, an assistant helps you work through the affected accounts and what to do next.
This is an inventory, not a backup of the private credentials on your keys. It does not prove that a second key can sign in to an account. In the current version, same-model keys without a serial number can share one history entry.
There is an important limit: only discoverable passkeys stored on the key can be listed. Classic U2F registrations, where the key acts as a second factor, are not stored on the device as an account list. KeyMelier cannot read something that is not there.
A tool that shows its limits.
The app can also manage PINs, passkeys and, on supported keys, fingerprints. Depending on the hardware, it supports OATH, OpenPGP, PIV and YubiKey OTP functions. The actual feature set depends on the device.
A function test runs through registration, sign-in and signature verification, much like a website, without storing anything permanently on the key. Security assessments distinguish between available, missing and failed evidence.
Try it. Break it. Help improve it.
KeyMelier is a young open-source project under the MIT licence. Test reports from different keys help expand coverage on real hardware. Bugs and ideas belong in GitHub Issues; the documentation covers platform requirements, privacy and known limitations.