- No passwords
You sign in with a passkey: your device plus Face ID, Touch ID or your PIN. It can't be phished.
- Your account key
It's created on your device and locked with your passkey.
Your machines only talk to devices this key approved.
- End-to-end encrypted
Every keystroke, every line of output and every approval is encrypted between your devices and your machines.
- Check words
Connecting a server shows the same three words on both screens. Nothing is added until you confirm them.
The code works once, expires after 10 minutes and never shows in the server's process list.
- New devices
A new device joins only with your passkey, your recovery key, or approval from a device you already use.
Approval takes a matching 6-digit number plus your passkey.
A removed device is cut off from every machine within about 2 seconds.
- Your AI sign-ins
Claude and ChatGPT sign-ins run in each app's own login on your machine.
They stay on that machine.
- Private notifications
Contents are encrypted on your machine before they're sent, so Apple and Google only carry sealed messages.
Hide details on the lock screen leaves out names, commands and questions.
- No open ports
Your machine connects out to Miko over HTTPS. Nothing needs to come in.
- Updates
Updates wait until no agent is working, and roll back by themselves if something fails.
- Agents on your server
Agents run as a separate user that can never log in. Your other home folders are hidden from them.
- Connections
Sealed on your device. Miko's servers store them locked. Only your machines can unlock them.
- Account recovery
Email recovery takes 3 days and warns every device and your email first.
Only allow passkeys turns email codes off.
Good to know
Previews are encrypted on the way, but not end to end like your terminals. Agents on one machine share its files. Where Miko can't check which agent asks for a key, as on Debian 12 by default, any agent on that machine could read it.
Every Miko computer runs with memory encryption (AMD SEV-SNP), in North America.