What a reset does
Each applet resets independently — wiping the FIDO function doesn't touch OATH, and so on. In every case the point is the same: keys and credentials are destroyed, not recoverable. Because the secrets only ever lived on the device, there is no backup to restore from unless you made one.
A whole-key reset is a sweep of independent steps, not a single atomic act. Each applet that completes comes back in factory condition, and every step reports its own outcome — so a run can legitimately end with some applets wiped, one failed, and the key still needing attention. Read the report; don't assume a clean slate because the command finished.
- FIDO2 — erases all resident credentials/passkeys and clears the PIN. Any account relying solely on this key for sign-in is locked out until you register a replacement. FIDO2 →
- OATH — removes all stored TOTP/HOTP seeds and clears the applet password. It needs no password to run, which makes it the only way back from a forgotten one. You'll need each service's setup secret/QR again. OATH →
- OpenPGP — destroys the on-card sign/encrypt/auth keys and resets PINs. Anything encrypted to the card's encryption key becomes undecryptable. OpenPGP →
- PIV — clears slots, certificates, PIN/PUK, and management key. A whole-device reset reaches PIV the manufacturer-intended way: the PIN and then the PUK are deliberately blocked, and only then is the applet wiped. If the run stops in between, PIV stays locked and un-wiped until a reset finishes — the per-step report says which state it is in. keyroost checks for the vendor RESET instruction before it blocks anything and refuses cards that show no sign of implementing it, so a standards-only card is never left locked with no way back. PIV →
- Token2 on-device OTP — erases every OTP entry stored on the key's own applet. The key asks for a confirming button press before it wipes. On an R3.4+ key this is also the only way back from a blocked OTP PIN — there is no PIN reset. On-device OTP →
- Token2 Molto2 — factory reset wipes loaded slots and restores the default customer key; the token asks you to confirm with its own button. Molto2 →
Before you reset — the checklist
- Have another way in. A second registered key, or current recovery codes, for every account this key unlocks. Verify it works before wiping.
- Re-derive what you'll re-add. Make sure you can re-enroll OATH seeds and regenerate or re-import OpenPGP/PIV keys.
- Decryption keys are special. Data encrypted to an OpenPGP encryption key or PIV key-management slot can't be read after the key is gone — decrypt or re-key it first.
- Then reset, set a fresh PIN, and re-register before relying on it.
A reset can't be reversed and the destroyed keys can't be regenerated from the device. When in doubt, stop and confirm your recovery path first.
How keyroost treats resets
A destructive command never guesses which key it is aimed at. With one key
connected it uses that key; with several it refuses until you name
one with --device, and it rejects --reader and
--device together, since those can name different keys. Every wipe also
needs an explicit --yes. Reset support spans the FIDO2, OATH, OpenPGP,
PIV, Token2 on-device OTP, and Molto2 applets; read-only inspection
(list, fido info, piv status) never changes
anything and never needs a PIN.
Resetting a whole key at once
One command wipes every resettable applet the key exposes, in order — OATH, OpenPGP, PIV, Token2 on-device OTP, then FIDO2 last, because it ends with a ceremony:
keyroostctl factory-reset --yesThe card applets run silently; the OTP step wants a confirming button press on the
key. What the FIDO2 step asks for depends on the device's shape. A USB
key is prompted for an unplug, replug, and touch — keyroost pins the key's
identity before the sweep starts and verifies the key that comes back after
the replug is the one you confirmed; a key that exposes no serial is accepted
only when it is unambiguously the only one connected. A card in a smart-card
reader has nothing to unplug and no touch surface, so it is reset in place:
keyroost power-cycles the card in the reader (which opens the same brief
after-power-up window a replug does) and sends the wipe immediately. The same
in-place path is available on its own as
keyroostctl fido reset --yes --reader <name>. Each step prints its
own result and the command exits nonzero if anything failed.
The desktop app offers the same sweep as a Factory reset card on a key's Overview tab, with a live per-step report — including a FIDO2 row — so you can see exactly which applets came back clean and which need another pass.
The Token2 Molto2 is not part of this sweep; it has its own
keyroostctl molto reset --yes, which also needs a physical button
confirmation on the token. Molto2 →