ToothPaste

ToothPaste is an open-source wireless bridge for sending keyboard and mouse input from a browser to almost any device that accepts a USB keyboard. It targets situations where installing software or completing a conventional login is impractical: entering a long password on an air-gapped computer, controlling a tablet, or using a machine that supports only USB input. A web app communicates with an ESP32-S3 over Bluetooth Low Energy; the device then presents itself to the target computer as a USB human-interface device and types the received commands. The design avoids a server or cloud service, and the project also describes media control, pentesting, and replayable “Ducky” scripts. Getting started can involve flashing firmware through the web app, though that route requires a Chromium-based browser; firmware can also be built or flashed separately.

The central concern is protecting sensitive input despite Web BLE’s limited “just works” pairing, which leaves Bluetooth communication vulnerable to interception. ToothPaste therefore combines ECDH key exchange, an out-of-band component, and AES-256 encryption so only authenticated transmitters can send commands for the device to type. Version 2 adds a Microchip ATECC608B secure element: private credentials are generated and held in isolated hardware rather than ESP32 flash, reducing exposure even if the device is physically accessed. The project contrasts this hardware-backed protection with Version 1’s software-bound credentials and describes custom assembled boards, including USB-C and USB-A options. Its implementation spans ESP32 firmware and a JavaScript/React web app; the firmware can be built with ESP-IDF, while packet development also uses Protocol Buffers tools.