Sound Waves Bring Back the Keyboard Without Any Keys

A smartphone browser turns typed text into audible pulses; an Arduino Micro listens, decodes them, and appears to the computer as an ordinary USB keyboard. No apps, no drivers, no special cables beyond the board itself. Maker nicolas.ma published the complete build as a sound-controlled macro keypad and then extended the same idea into a password manager that keeps secrets off the phone.

The approach reaches back to dial-up acoustic modems and intentional air-gap channels, then puts them to work against modern smartphone lock-in.

The Phone Speaks in Pulses

Everything starts in a plain web page running on any modern phone browser. The user types or selects text. The page converts the characters into a stream of on-off audio tones and plays them through the speaker.

• Open the static HTML page (no install required).
• Enter or recall the message; it can live in localStorage under the user’s control.
• Hold the phone near the microphone module.
• The page emits the tones; the Arduino side decodes and types.

The emitter needs nothing more than a browser and a speaker. It can be hosted anywhere, including the live browser page that emits the tones. That single fact already jumps the usual smartphone barriers: no USB-C host mode fights, no app-store approval, no custom drivers on the phone side.

Hardware That Listens and Types

The receiving end is deliberately simple. An Arduino Pro Micro (or Micro) sits at the center because its ATmega32U4 includes native USB device support. Once programmed, the board enumerates as a standard HID keyboard. A cheap KY-037 sound sensor module feeds the digital output into one of the board’s pins.

The KY-037 sound sensor specs list a 20 Hz-20 kHz electret capsule, LM393 comparator, and both digital and analog pins. The project uses the digital path for speed: presence of oscillation equals binary 1, silence equals 0. Analog FFT routes were tried and discarded because they could not beat the simple pulse approach.

Protocol Built for Reliability

nicolas.ma designed a minimalist on-off-keying scheme that still carries integrity checks and variable message lengths. Each word can be eight bits for a character or a type field that tells the receiver how long the rest of the frame will be. The final bit of every word is the inverse of the one before it; that guaranteed transition flushes the word into memory. A CRC closes the frame. Link-state checks let the device confirm the channel is alive.

2 ms per bit is the measured rate, roughly 500 bit/s or about 62 bytes per second. That is slow by modern wireless standards and perfectly usable for passwords, macros, or short commands. The code and the HTML emitter sit together on the project page with its full project files and protocol notes.

The same protocol is extensible. Later notes mention adding mouse movement, infrared commands, or encrypted payloads that the Arduino decrypts with keys held only on the device side.

Password Vault That Never Leaves the Air Gap

The most polished application so far is KeyWhisper. The vault and the bulk of the master key stay on the computer. Only a short fragment travels by sound. The phone browser never holds a complete password.

Send your passwords by sound. KeyWhisper is a small password manager whose vault stays on your computer. To use a password on another device, you don’t type or copy it, you play a short sound from a web page, and KeyWhisper hears it, rebuilds the password locally, and puts it on your clipboard (or types it for you). The password itself never travels; only a harmless key fragment does.

That description comes straight from the KeyWhisper air-gapped password vault README. Setup splits the master key into three pieces: a 128-bit random part stored only on the PC, a short secret the user remembers, and a PIN. The sound channel carries only the middle fragment. Vault encryption uses PBKDF2-HMAC-SHA256 with 200 000 iterations and AES-256. Wrong credentials produce silence rather than an error message. An optional one-time temporal mask (SHA-256 of a secret plus a 120-second window) further hides the fragment when the page is served over HTTPS or localhost.

The receiver runs as a local Python app that listens continuously or on demand, rebuilds the password, and either copies it or auto-types it. Site names can be exported as a plain list so the phone page knows which entries exist, still without ever seeing the secrets.

Sound Waves Still Beat App Stores

Smartphone operating systems treat USB host mode, custom HID, and background audio as privileged or restricted actions. A static web page that simply plays tones needs none of those privileges. The computer side sees only a keyboard. That combination revives techniques older than most of the readers of this site.

1. 1960s-1990s, Acoustic-coupled dial-up modems turned data into audible tones that traveled ordinary telephone handsets.
2. 2010s, Research groups demonstrated malware that jumped air gaps with inaudible ultrasonic or near-ultrasonic channels between nearby laptops.
3. Commercial attempts, Chirp and similar libraries packaged data-over-sound for marketing and device pairing.
4. 2025-2026, nicolas.ma’s open OOK and later FSK implementations put the same physics into a browser-to-HID keyboard and a practical password tool.

The usual security literature treats keyboard acoustics as a liability: papers have shown AI models recovering keystrokes from Zoom audio or nearby microphones with high accuracy. Here the channel is intentional, short-range, and under the user’s control. The phone becomes a dumb, air-gapped emitter rather than a networked vault.

That pattern also sits beside other recent experiments that turn phones into input devices. Southco’s Bluetooth controller and similar gadgets explore other phone-to-physical-key approaches, while larger companies keep shipping novel form-factor keyboards such as OpenAI’s own compact hardware keyboard. The audio route is simply the one that needs the least permission from the phone OS.

Limits Speed and Noise Set

Five hundred bits per second is fine for a 20-character password and slow for bulk text. Background noise, speaker volume, mic sensitivity, and distance all affect reliability; the digital threshold on the KY-037 must be tuned with its onboard potentiometer. The current implementation favors robustness over raw throughput. Higher-order schemes (FSK variants already present in KeyWhisper’s modem library) can raise the rate when the environment is quiet.

Physical security still matters. Anyone who can record the audio and already knows the other key fragments could reconstruct the password. The design therefore keeps two of the three factors permanently off the air and off the phone. The Arduino itself is a trusted USB device; like any other programmable HID board it can be used for good or mischief once plugged in.

Extensions already sketched include mouse macros, infrared blasting, and optional Web Cryptography encryption of the payload so even the audio stream carries ciphertext. Because both the emitter and the decoder are open, anyone can harden or accelerate the link.

Frequently Asked Questions

How does the audio keyboard actually transmit text?

The phone browser encodes characters as on-off audio pulses (presence of tone = 1, silence = 0). The Arduino Micro reads the digital output of a KY-037 microphone module, buffers the bits, applies the variable-length word format and CRC check, then injects the decoded characters as ordinary USB HID keystrokes. No Bluetooth, Wi-Fi or custom phone app is involved.

What hardware do you need to build one?

An Arduino Pro Micro or Micro (ATmega32U4), a KY-037 sound sensor module, jumper wires, and any smartphone with a browser and speaker. The complete Arduino sketch and the static HTML emitter are downloadable from the Hackaday.io project page under a GPL-3 license.

How fast is the sound link?

The published OOK implementation runs at 2 milliseconds per bit, or roughly 500 bits per second (about 62 bytes per second). That is enough for passwords and short macros; KeyWhisper’s multi-protocol modem library already includes faster FSK options for quieter environments.

How does KeyWhisper keep passwords off the phone?

The encrypted vault and two of the three master-key parts remain on the computer. The phone browser only ever emits a short remembered fragment (optionally masked by a time-window one-time pad). The receiver combines the fragment with its local secrets, decrypts the needed entry, and places the result on the clipboard or types it. The full password never exists on the phone or in the audio stream.

Can the transmission itself be encrypted?

Yes. The project notes that the Web Cryptography API can encrypt the payload on the browser side; the Arduino then decrypts with a key held only on the device. KeyWhisper already demonstrates an optional temporal mask that changes every 120 seconds when the page is served securely.

The build is small, open, and already useful. A few dollars of parts and a browser page restore a keyboard that has no keys of its own, while the same sound channel gives passwords a path that never crosses a network or an app store.