Resetting a key, safely

What a reset does

Each applet resets independently — wiping the FIDO function doesn't touch OATH, and so on. In every case the point is the same: keys and credentials are destroyed, not recoverable. Because the secrets only ever lived on the device, there is no backup to restore from unless you made one.

A whole-key reset is a sweep of independent steps, not a single atomic act. Each applet that completes comes back in factory condition, and every step reports its own outcome — so a run can legitimately end with some applets wiped, one failed, and the key still needing attention. Read the report; don't assume a clean slate because the command finished.

• FIDO2 — erases all resident credentials/passkeys and clears the PIN. Any account relying solely on this key for sign-in is locked out until you register a replacement. FIDO2 →
• OATH — removes all stored TOTP/HOTP seeds and clears the applet password. It needs no password to run, which makes it the only way back from a forgotten one. You'll need each service's setup secret/QR again. OATH →
• OpenPGP — destroys the on-card sign/encrypt/auth keys and resets PINs. Anything encrypted to the card's encryption key becomes undecryptable. OpenPGP →
• PIV — clears slots, certificates, PIN/PUK, and management key. A whole-device reset reaches PIV the manufacturer-intended way: the PIN and then the PUK are deliberately blocked, and only then is the applet wiped. If the run stops in between, PIV stays locked and un-wiped until a reset finishes — the per-step report says which state it is in. keyroost checks for the vendor RESET instruction before it blocks anything and refuses cards that show no sign of implementing it, so a standards-only card is never left locked with no way back. PIV →
• Token2 on-device OTP — erases every OTP entry stored on the key's own applet. The key asks for a confirming button press before it wipes. On-device OTP →
• Token2 Molto2 — factory reset wipes loaded slots and restores the default customer key; the token asks you to confirm with its own button. Molto2 →

Before you reset — the checklist

1. Have another way in. A second registered key, or current recovery codes, for every account this key unlocks. Verify it works before wiping.
2. Re-derive what you'll re-add. Make sure you can re-enroll OATH seeds and regenerate or re-import OpenPGP/PIV keys.
3. Decryption keys are special. Data encrypted to an OpenPGP encryption key or PIV key-management slot can't be read after the key is gone — decrypt or re-key it first.
4. Then reset, set a fresh PIN, and re-register before relying on it.

How keyroost treats resets

Resetting a whole key at once

One command wipes every resettable applet the key exposes, in order — OATH, OpenPGP, PIV, Token2 on-device OTP, then FIDO2 last, because its reset needs an unplug/replug and a touch:

keyroostctl factory-reset --yes

The card applets run silently; the OTP step wants a confirming button press on the key; the FIDO2 step prompts you to re-plug and touch. keyroost pins the key's identity before the sweep starts and verifies the key that comes back after the replug is the one you confirmed — a key that exposes no serial is accepted only when it is unambiguously the only one connected. Each step prints its own result and the command exits nonzero if anything failed.

The desktop app offers the same sweep as a Factory reset card on a key's Overview tab, with a live per-step report — including a FIDO2 row — so you can see exactly which applets came back clean and which need another pass.

The Token2 Molto2 is not part of this sweep; it has its own keyroostctl molto reset --yes, which also needs a physical button confirmation on the token. Molto2 →