Your KŌINIkeystick turns a computer into a temporary, offline machine that creates your seed phrase and then ceases to exist when you pull the power. Before that can happen, most computers need two settings changed — and changed back afterward. This page walks you through it, step by step, for your exact computer. No experience needed.
Why this is needed, in plain words. Modern computers ship with a gatekeeper called Secure Boot that only starts operating systems approved by Microsoft. The keystick carries its own tiny operating system — deliberately not Windows — so the gatekeeper has to be asked to step aside for a few minutes. Windows computers also usually encrypt their disk (BitLocker), and BitLocker raises an alarm if boot settings change while it is standing guard. So the safe order is always: pause BitLocker first, then Secure Boot off, boot the stick, then put both back. Your files are never touched — the keystick has no access to your disk at all, by design.
Two things worth checking before you start. The keystick needs a computer with a processor from 2012 or newer. And a few kinds of devices cannot run it at all, Chromebooks among them, whatever brand is on the lid. The full list is on the not supported devices page.
Pick the brand on the machine you will boot the stick on. Not sure? The brand is printed under the screen or on the case.
Using a Chromebook? Any brand of Chromebook runs ChromeOS and cannot run the stick as it ships, so there is no brand to pick here. See the not supported devices page instead.
Some computers were made before Secure Boot existed, so there is no setting to find and nothing you did wrong. Secure Boot is only an obstacle these steps remove. The keystick does not need it, and on your machine it was never there. Skip the Secure Boot part entirely and go straight to booting the stick from the boot menu. There is nothing to change back afterward, and machines of that age usually do not have BitLocker either, so that part rarely applies. One more difference on older machines: the boot menu may not show a UEFI heading. Just pick the entry that names your USB stick. It may appear under a plain name such as USB Storage Device.
On a small number of machines the built-in keyboard and trackpad are not recognized in the boot environment, so nothing happens when you press Enter at the first screen. The fix is simple: plug in a wired USB keyboard and use it for the ceremony. Wired keyboards are inexpensive and work in the boot environment on almost any machine. This is most common on machines whose original operating system has been replaced, including Chromebooks that were converted to run a different system.
The two changes are settings, not surgery, and both are reversed at the end. The keystick itself runs entirely in memory and cannot see or touch your disk — the system it boots has no disk drivers at all. The one real risk is skipping the BitLocker pause on Windows: then your own computer may demand its recovery key at next start. That is why pausing BitLocker is always step one, and why we show you where your recovery key lives before anything else.
Microsoft operates a signing program for third-party systems, and vendors can apply to it. We chose to ship first with these instructions because a signature adds a party you have to trust. Either way, the honest position is the same: you don't have to trust the stick blindly — its entropy path is independently reviewed, and every stick ships under a tamper-evident seal.
No — the stick cannot write to your disk or your settings. That screen is Windows itself reacting to the boot-settings change, and your files are intact behind it. Your key is at account.microsoft.com/devices/recoverykey — sign in with the Microsoft account used on that computer, enter the 48-digit key, and Windows starts normally. Then come back here and follow your brand's steps in order, which prevents the alarm from tripping again.
Real dice are still our top recommendation, and it is worth understanding why: the dice exist for one disaster — a computer's built-in randomness being secretly broken. A physical die answers only to physics; it depends on no computer's randomness being sound. That is a guarantee no software can match, which is why it stays our first choice.
But not every digital roller is the same, so here is the honest ladder. Avoid generic random-number websites and apps: a website's server can log the numbers it hands you, and many apps sync to the cloud — either way your rolls leave your hands, which is the whole thing the dice are meant to prevent. If you would rather not roll by hand, KŌINI makes two tools built to avoid exactly that: dice.koini.io and the KŌINIdice app. Both roll 99 dice using your own device's cryptographic randomness and keep every number on your device — nothing is sent to a server, nothing is synced, and the tools have no idea what a blockchain is; they just roll dice. They are a good option. Physical dice are still the best one, because they rely on no randomness source at all.
And the simplest path is always there: skip dice at the prompt, and you get the same machine randomness every store-bought hardware wallet relies on — stated plainly, nothing pretended.
The system on the stick has no ability to write to the computer's storage — no disk drivers exist in it, and it refuses to run if it finds a writable disk mounted, a network interface, or active swap. When the power goes, the environment and everything in it is gone. What remains is what you wrote on paper, and nothing else.
Don't use the stick. Contact support@koini.io. We'll send a replacement.
KŌINIkeystick · published by KŌINI · support@koini.io
This page changes only two settings and tells you how to change them back. If anything on your screen does not match these steps, stop and write to us — screenshots welcome.