About HID Crescendo Manager

Crescendo Manager provides a simplified way to manage your HID Crescendo® devices quickly and efficiently.

Generate and manage key pairs and digital certificates, certificate signing requests, configure and generate one-time passwords, and set up PIN and management keys through an intuitive, user-friendly interface.

Supported Devices

The following devices are fully supported:

  • Crescendo 2300 Card
  • Crescendo Key (2300 Series)
  • Crescendo 4000 Card
  • Crescendo Key V3 (4000 Series)
  • Crescendo 1150 Card (standalone)
  • Crescendo 144K Card
Tip! Multiple devices (readers and tokens) can be connected simultaneously.
Tip! Multiple instances of Crescendo Manager can be opened and used at the same time.

Supported Operating Systems

Microsoft Windows

  • Microsoft Windows 10 (64-bit edition), version 21H2 and later

  • Microsoft Windows 11, starting from version 23H2 and up to version 25H2 (inclusive)

  • Microsoft Windows 11 ARM64, starting from version 25H2

  • Microsoft Windows Server 2019

  • Microsoft Windows Server 2022

  • Microsoft Windows Server 2025

Note: Crescendo Manager may be compatible with some older versions, but they are not officially supported.
Note: For installing Crescendo Manager on the Windows Server Core (Datacenter), Server Core App Compatibility Feature must be installed.

MacOS

  • MacOS 14 and later, compatible with both Intel and Apple Silicon chips

Release Notes

What's New in v9.6.1

Note: Version 9.6.0 was not released publicly. Version 9.6.1 is the first public release in the 9.6 series.

Main New Features and Improvements

  • Write support is now available for Crescendo 2300 Card and Crescendo Key V1.

  • Read/write support is now available for Crescendo 1150 Card in standalone configuration.

  • Read/write support is now available for root and intermediate CA certificates on:

    • Crescendo 4000 Card and Crescendo Key V3 (4000 Series)

    • Crescendo 2300 Card and Crescendo Key V1 (2300 Series)

    • Crescendo 1150 Card

    • Crescendo 144k Card

  • The device firmware update feature for Crescendo Key V3 (4000 series) has been added.

  • Support for FIDO-only devices has been added. The following functionalities are now enabled:

    • Reading and deleting credentials

    • Device recycling

    • Personalization, i.e. setting the PIN

    • Changing the PIN

  • Support for Crescendo Manager on Windows ARM has been added.

  • The FIDO Authenticator Info dialog has been added and includes Enterprise Attestation (EA) information as well as other authenticator details.

General Improvements and Bug Fixes

  • Fixed an issue where the Settings and About links were displayed incorrectly in the menu bar on MacOS.

  • Removed the non-functional starting screen selector from the Settings view.

  • Replaced the FIDO icon with the official one.

  • Fixed an issue where automatic cache clearing could repeatedly trigger a progress indicator, resulting in a poor user experience.

  • Fixed an issue in certain corner cases when parsing PFX/P12 files.

  • Fixed issues in the Identity view where certain face images could cause the application to freeze due to an end-of-file error during image decoding, and where cardholder information was not displayed in some cases because the underlying byte data was parsed incorrectly.

  • Fixed an issue where the progress indicator was not properly dismissed when the user navigated away to another page, such as by removing the card during an ongoing operation.

  • Fixed a potential crash when loading a corrupted certificate on a Crescendo card.

  • Fixed an issue that caused public keys on Crescendo 144k smart cards to be encoded incorrectly.

  • Fixed an issue that affected the personalization of Crescendo 2300 smart cards when Force PIN Change was enabled.

  • Fixed an issue that caused private keys to be displayed twice for Crescendo 2300 cards.

  • Fixed an issue where cards without a cache freshness buffer were not handled correctly, which could prevent the application from detecting changes after a token reset by another product.

  • Fixed an issue where logging messages for console applications using the middleware were displayed in the console; these messages are no longer shown.

  • Fixed an issue where uploading certificates to the Windows Certificate Store from the Certificates view did not work.

Known Limitations

  • In some corner cases, sharing tokens via Windows App (formerly known as RDP) from macOS may not work as expected.

  • If the last CA certificate on a token is deleted, subsequent attempts to import any CA certificate (including the same one) will fail. Importing CA certificates will not be possible until the token is removed and reinserted, the token caches are cleared, or Crescendo Manager is restarted.

Note: Starting with v9.5, the version number aligns with the versioning convention used across the related product portfolio.

Main New Features and Improvements

  • FIDO support

    • A new FIDO section allows viewing and deleting FIDO credentials on Crescendo 4000 devices.

    • The APDU Access tool now supports selected FIDO-related operations including:

      • Setting and changing the FIDO PIN

      • Retrieving PIN retry count

      • Getting token info

      • Listing and deleting credentials

  • Token Selector display configuration

    • The Token Selector in the title bar can now be configured to display both the reader name and token name in its non-expanded state.

  • Clear Cache for non-personalized tokens

    • The Clear Cache action, accessible from the token tile, is now available for non-personalized tokens.

  • Personalize dialog

    • A Recycle Device checkbox has been added to the Personalize dialog.

  • Support for non-personalized token usage

    Non-personalized tokens can now be fully used.

    Actions requiring authentication automatically use the factory default PIN with no prompt.

    In the Devices view only the Clear Cache and Personalize actions are available.

    The Authentication Button displays a yellow warning instead of the padlock.

General Improvements and Bug Fixes

  • Fixed issue causing delays when closing the application.

  • Fixed missing and non-draggable scroll bars.

  • Force PIN change

    • When a PIN policy is configured to enforce a PIN change, the dialog now clearly warns that the new PIN must differ from the current one.

  • Improved performance of the Deauthentication Button

    • Fixed an issue where the deauthentication button was incorrectly defined, causing delays in execution. The operation completed successfully, but took longer than expected.

Main New Features and Improvements

  • Support for Crescendo 144K Cards

  • The Recycle Device action now leaves the token in factory state without automatically performing the Personalization action. The token must be Personalized manually after recycling.

  • Identity view:

    • Signature validation added to the Personal Information tab

    • Data loading indication added

    • Support for fingerprints and facial data

  • Certificates view:

    • Upload to certificate store/keychain button added in the page header

    • Upload to certificate store/keychain button added to Certificate Details dialog

  • Token data loading indication added

  • PUK management

    • Improved Manage PUK dialog UI

    • If only one PUK management-related action is available, the kebab menu displays the action name directly. If multiple actions are available, the Manage PUK option is displayed.

    • Actions in the Manage PUK dialog have been renamed to Configure PUK, View PUK, and Delete PUK

  • FIDO Shared PIN: The FIDO and PKI PINs can now be set to be shared in PIN policies.

  • Improved handling of a blocked PIN

    • In the Devices view, a warning is displayed on the token tile with only the Unblock PIN operation enabled. Other write operations are properly disabled.

    • The Unblock PIN dialog now displays a warning when the PIN is not blocked.

  • macOs: Improved smart card insertion handling for dual interface readers, eliminating the brief display of a contactless token when inserted into the contact slot.

  • Data obfuscation mechanism for full APDU logging: Some sensitive data (including private keys during import, PINs, PUKs, management keys, and cardholder information) are now obfuscated even if full APDU logging is enabled. Note that some sensitive data may still appear in the log file when full logging is enabled.

General Improvements and Bug Fixes

  • macOS: Fixed required re-authentication issue when generating OTPS, even when already authenticated.

  • Certificates are now correctly matched against private keys when importing P12 files using the drag and drop feature, preventing the import of a non-matching pair.

  • Fixed an issue where changing the PIN on 2300 cards did not remove the Force PIN Change flag when PIN change was forced.

  • Removed unnecessary reloading on the OTP page, which was causing screen blinking.

  • Fixed a bug that could cause the application to be displayed outside the visible area after a display layout change.

  • Fixed handling of management (xauth) keys not being initialized on the token. Management key will no longer be offered as a PIN unblock option in such cases.

Main New Features

  • MacOS support: Crescendo Manager is now compatible with MacOS.

  • Access Control Configuration feature added for OTP configuration on the Crescendo 4000 Family.

  • Button Press Actions configuration for Crescendo Keys:

    • V1: Supports single press with HOTP.

    • V3: Supports single and double press with HOTP or static password.

General Improvements and Bug Fixes

  • QR code scanning: Improved handling; the Crescendo Manager window hides during scanning and restores afterward.

  • Disabled actions: Actions are now shown as disabled when unavailable, extending functionality previously limited to Certificates.

  • Certificate generation: IP address format in the SAN (Subject Alternative Name) extension is now validated.

  • Certificate import:

    • General-purpose slots on the Crescendo 2300 Family are no longer selectable for import.

    • The Import button remains enabled when all slots are occupied, provided some contain only private keys (without certificates).

  • Devices view: Removed display of Windows Hello.

  • Settings: Added Token Unsupported Functionality Display Mode (Hide vs Show disabled).

Tip!

To access documentation for other releases, visit the Crescendo Manager documentation page.