---
name: "hcsecd"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/hcsecd"
---

# hcsecd(8)

control link keys and PIN codes for Bluetooth devices

## NAME

**hcsecd** – control link keys and PIN codes for Bluetooth devices

## SYNOPSIS

**hcsecd** \[**-dh**\] **-f** *configfile*

## DESCRIPTION

The **hcsecd** daemon controls link keys and PIN codes for Bluetooth devices. It opens a raw HCI socket and listens for Link\_Key\_Request, PIN\_Code\_Request and Link\_Key\_Notification HCI events.

Once a Link\_Key\_Request or PIN\_Code\_Request HCI event is received, the daemon scans the configuration file for a matching entry. The remote device BD\_ADDR is used as a key. If no matching entry was found, the default entry will be used. If no default entry was found then it is assumed that no link key and no PIN code exists. For any given entry, the link key takes precedence over the PIN code. If a link key was not specified, the device must generate the link key from the PIN code. If an entry was found and the link key (or PIN code) exists, the Link\_Key\_Request\_Reply (or PIN\_Code\_Request\_Reply) command will be sent back to the device. Otherwise, the Link\_Key\_Request\_Negative\_Reply (or PIN\_Code\_Request\_Negative\_Reply) command will be sent back to the device.

The **hcsecd** daemon also handles HCI Link\_Key\_Notification events and caches link keys created from the PIN codes in memory. To preserve link keys between restarts the **hcsecd** daemon dumps link keys for all entries in the */var/db/hcsecd.keys* link keys file. If it exists, the link keys file gets processed by the **hcsecd** daemon after it processes its main configuration file. The link keys file gets written every time the **hcsecd** daemon shuts down gracefully. It is possible to force the **hcsecd** daemon to re-read its main configuration file and dump the link keys file by sending the HUP signal to the **hcsecd** process. The user is expected to not modify the link keys file by hand.

The command line options are as follows:

- **-d**

  Do not detach from the controlling terminal.

- **-f** *configfile*

  Specify the name of the configuration file. The default is */etc/bluetooth/hcsecd.conf*.

- **-h**

  Display usage message and exit.

## FILES

- */etc/bluetooth/hcsecd.conf*

  - */var/db/hcsecd.keys*

  - */var/run/hcsecd.pid*

  ## SEE ALSO

[ng\_btsocket(4)](/ng_btsocket/4.md), [ng\_hci(4)](/ng_hci/4.md), [hcsecd.conf(5)](/hcsecd.conf/5.md), [hccontrol(8)](/hccontrol/8.md)

## AUTHORS

Maksim Yevmenkin ⟨*m\_evmenkin@yahoo.com*⟩

## BUGS

Currently there is no way to select the link key or the PIN code based on which local device received the request. Everything is based on the remote device BD\_ADDR. An interface for external helpers to obtain link keys and PIN codes is missing.