PassVault GitHub

v0.1 · open source · GPL-3.0-only

Your passwords.
On your phone.
Nowhere else.

A fully offline password vault for iOS and Android. Encrypted with Argon2id and XChaCha20-Poly1305, with imports from BlackBerry Password Keeper, KeePass, Bitwarden, 1Password and more.

Get it onGoogle Play Get the Android APKGet APK Build for iOS
  • No account
  • No server
  • No analytics
  • No cloud sync

// 01 · air-gapped by design

There is nothing to hack in the cloud, because there is no cloud.

Everything happens on your phone. Your master password unlocks the vault, and nothing leaves the device unless you export a file yourself. No sign-in, no sync, no telemetry. The Android app doesn't even ask for the Internet permission.

0network permissions
0accounts & servers
100%on-device
AndroidManifest.xml
<manifest>
  <uses-permission name="USE_BIOMETRIC" />
  <uses-permission name="HIDE_OVERLAY_WINDOWS" />
  <!-- Deliberately no INTERNET permission. -->
</manifest>
PassVaulton your phone Vaultencrypted Internetcloud · servers never connects

// 02 · features

Everything a vault needs. Nothing it doesn't.

Easy, safe unlocking

Master password or fingerprint / face. Biometrics release a key protected by the OS, not a UI flag.

Encrypted on device

Every record is authenticated ciphertext, stored locally. Only you can open it, and nothing is uploaded.

Find things fast

Search, star favourites and organise records into colour-coded groups.

Flexible records

Several usernames, passwords, notes and security Q&A in one record, in any order. Secrets stay hidden until revealed.

Password generator

12–128 characters from OS / libsodium randomness with rejection sampling: no modulo bias.

Password history

Changing a password keeps the last 10 values with timestamps, encrypted with the vault.

Wallet seed phrases

Store BIP-39 phrases and private keys. Validated, hidden by default, excluded from CSV exports.

2FA codes

Built-in TOTP generator. Scan or paste a secret and get rotating one-time codes next to the login they belong to.

Careful clipboard

Local-only, auto-expiring on iOS; marked sensitive and cleared on Android. Seed phrases never touch it.

Backup & restore

CSV or encrypted export, re-authorised with your password. Encrypted backups move between iOS and Android.

Capture protection

FLAG_SECURE, overlay hiding and autofill exclusion on Android; a privacy cover on iOS.

Auto-lock

Immediately, after 1 or 5 minutes away, or when the device locks. Screen-off always locks.

// 03 · under the hood

Established cryptography, not clever cryptography.

libsodium on both platforms. A random data key is wrapped with a password-derived key and a device-bound secret held by the Keystore / Keychain.

  1. 01Master password≥ 12 chars, mixed classes
  2. 02Argon2id v1.364 MiB · 3 passes · 1 lane
  3. 03256-bit key+ device-bound secret
  4. 04XChaCha20-Poly1305192-bit nonce · 128-bit tag
  5. 05Ciphertexton this phone only

Try the generator

runs in your browser
 

0 bits of entropy · —

Same method as the app: crypto.getRandomValues + rejection sampling. Nothing is sent anywhere.

Ten strikes, then it's gone

simulation

After 10 consecutive wrong master passwords the vault on that device is cryptographically erased. Each attempt is reserved durably before the password is checked, so killing the app mid-check still counts.

vault: locked · 0 / 10 failed

Biometric unlock resets the counter. There is no password reset: if you forget it, nobody can recover it.

// 04 · moving in

Bring your passwords with you.

Export from your old password manager and import the file. PassVault recognises the format from the file itself, on both iOS and Android, and authenticator keys come across as 2FA entries.

  • BlackBerry Password Keeper.pkb2 · CSV

    .pkb2 keeps every field: extra usernames, passwords, custom fields and history, in their original order. CSV keeps only the basics.

  • KeePass · KeePassXC.kdbx · XML

    Database password and key file. Groups, history, expiry dates, custom fields and TOTP keys.

  • BitwardenJSON · CSV

    Logins, cards, notes, folders, custom fields, password history and TOTP keys. Use plain JSON, not JSON (Encrypted).

  • 1Password.1pux · CSV

    Logins, cards, notes, tags as groups, password history and one-time passwords.

  • Chrome · Edge · Firefox · SafariCSV

    The browser's own password export.

  • LastPass · Dashlane · Proton Pass · othersCSV

    Any CSV with name/URL and username/password columns.

Attachments are not imported. Twofish KeePass databases: switch to AES or ChaCha20 first.

  1. Export from your old manager. Prefer the richest format: .pkb2, .kdbx, .1pux or JSON.
  2. Transfer the file to your phone locally, over USB or AirDrop.
  3. Import: unlock PassVault → Settings → Import, and pick the file.
  4. Unlock it with the export or database password if it has one. CSV needs none.
  5. Confirm the record count, then choose Import to merge or Full replacement to make the file the golden source.
  6. Verify your records, then delete the plaintext file.

// 05 · get it

Two native apps. One vault format.

Android

11+ · Kotlin · Compose

Install from Google Play, or grab the signed APK from GitHub Releases, open it on your phone and allow Install unknown apps.

Get it onGoogle Play Download APKGet APK 
$ cd android
$ ./gradlew :app:assembleDebug

iOS

17+ · Swift · SwiftUI

Build it yourself with Xcode and XcodeGen, choose your signing team and run on a real device.

Build instructions 
$ cd ios && xcodegen generate
$ open PassVault.xcodeproj