keycross

Type passwords into remote consoles that mangle your keyboard layout.

When you reach a server through a virtual console — Dell iDRAC, HPE iLO, a generic IPMI/KVM, or a VNC-based browser console — the console often turns what you paste into scancodes using your local layout, and the server reads those scancodes with its own layout. If the two layouts differ (say you're on QWERTY and the server is AZERTY), your password comes out scrambled and you can't log in.

keycross computes the string you should paste so that, after this round-trip, the server receives your real password.

$ echo 'C9Dt6Qh*LDUeZNREgT2ibTrz*JwKu_qP' | keycross paste
C(Dt^Ah\LDUeWNREgT@ibTrw\JzKu8aP

Paste that second string into the console; the server sees the first.

Install

cargo install --path .        # from a clone
# or
cargo build --release         # binary at target/release/keycross

Single static-ish binary, no runtime dependencies — drop it on any machine.

Usage

The password is read from a hidden prompt, from piped stdin, or from the clipboard — never from argv, so it stays out of your shell history.

Transform a password (paste, the default command)

keycross                       # hidden prompt; local US, server FR (defaults)
keycross paste -l fr -r us     # local AZERTY, server QWERTY
pass show servers/idrac | keycross      # from a password manager
keycross paste -c               # read the clipboard, write the result back to it

-l/--local is your keyboard, -r/--remote is the server's. Run keycross paste --help for the full list.

Don't know the layouts? (calibrate)

keycross calibrate

It gives you a probe string to paste into the console, asks what appeared on the server, and deduces the layout pair.

Generate paste-safe passwords (gen)

keycross gen -n 5 -L 28         # prints each password and its paste form
keycross gen --safe             # only chars that need no transform at all

--safe restricts the alphabet to characters that are identical through the round-trip, so the password can be typed directly on either keyboard.

Supported layouts

us (QWERTY) and fr (AZERTY) today. Adding one is a single table — see src/layouts.rs. Contributions for QWERTZ, UK, ES, BE, CH… welcome.

How it works

Every layout is a map from a physical key position to the characters it emits. For a desired server character d, the character to paste is the one your local layout puts on the same physical key that d sits on for the remote layout:

paste(d) = local.char_at( remote.pos_of(d) )

Both directions and all layout pairs come from this one relation — there are no hand-maintained per-pair tables.

Limitations

Characters only reachable via AltGr or a dead key on the target layout (e.g. @ # { } [ ] | \ ~ on AZERTY) can't be produced by a plain paste. keycross prints a warning listing them; avoid them in passwords you'll enter this way. The gen command already stays within the safe set.

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option. The repository is REUSE-compliant. Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.