1Key Password Manager

1Key is a local-first password manager for Android. Your vault lives on your device, encrypted with a key only you hold, and never moves unless you export it yourself. There is no account to create, no server to breach, and no network connection of any kind — the INTERNET permission is stripped from the manifest, so the operating system itself enforces the offline guarantee.

Security

• Vault key derived from your master password with Argon2id (m=64 MiB, t=3, p=1 by default; configurable up to m=256 MiB, t=16)

• Every credential field encrypted separately with AES-256-GCM, bound to its row and column via additional authenticated data — an attacker with raw database write access cannot swap ciphertexts between rows

• Master-password verifier stored in EncryptedSharedPreferences, itself wrapped by an Android Keystore-bound key (TEE or StrongBox where available), so offline brute-force of a leaked device image is not possible

• Optional 128-bit Secret Key mixed into the KDF for defense-in-depth against a compromised master password

• Biometric unlock backed by hardware-secure key; requires master-password confirmation to enable

• Tiered attempt limiting: 3, 5, and 10 wrong attempts trigger 30-second, 5-minute, and 1-hour cooldowns; counters survive process kills

Vault

• Store credentials with title, username, password, URL, notes, and custom fields

• Tag-based organisation, favourites, full-text search

• TOTP / 2FA codes stored in the same entry as the password they protect — no app switching

• Live-preview Markdown in notes with a helper bar; disable in Settings if you prefer plain text

• Soft-delete recycle bin (toggle off if you prefer immediate deletion)

• Credential history preserves previous values on edit

Autofill

• System-level Autofill Service — fill logins into any app or browser without leaving them

• URL-only matching by default (no fuzzy suggestions) to keep phishing risk down

• Save prompt on submit; per-action confirmation for cross-host URL saves

Backup and import

• Encrypted backup as a .1key file (AES-256-GCM with Argon2id key derivation)

• Plain CSV / JSON export for interoperability

• Direct import from Google Passwords, LastPass, KeePass, 1Password, Dashlane, NordPass, Safari / iCloud Keychain — auto-detects format, no manual column mapping

Unlock options

• Master password (always available)