Galaxit PWM

Galaxit ICT GmbH

About this app

Galaxit PWM is the native Android client for the Galaxit password manager of the same name (pw.galaxit.ch). Designed for Swiss SMEs and security-conscious private users, the app is based on a strict zero-knowledge model: Your private PGP key never leaves your device; the server only sees the encrypted data.

WHAT THE APP CAN DO

• Locally decrypted vault — all logins, notes, time-based one-time passwords (TOTP), and passkeys are stored PGP-armored on the server and can only be read
with the passphrase on your device.

• System autofill service — Galaxit PWM integrates with Android autofill and suggests logins directly in other apps and browsers (Settings → Passwords, Passkeys & Accounts → Autofill service).


• Passkey Provider (Android 14+) — The app registers as a
CredentialProvider; FIDO2 authentication uses a locally stored
ECDSA P-256 key, signed per request via biometrics. WebAuthn compliant with
byte-accurate compatibility with Apple Passkeys and Galaxit Web Vault.

• Multi-Account — Any number of pwpw accounts can be used simultaneously, each with
its own PGP key, biometric profile, and tenant. A star
PIN is set for the default account upon app launch.

• Multi-QR Pairing — Setup via browser: pw.galaxit.ch displays an animated
QR sequence, which the app scans. The private key is transmitted exclusively
by the camera; the server only knows the SHA-512 hash.


• TOTP Generator — RFC-6238 with Base32 secret, 6 digits, 30-second rotation.

Built-in QR scanner for otpauth: codes.

• Cross-Device Approval — When you initiate a login on the desktop,

the confirmation request appears as a push notification on the phone;

Approval only with biometrics (BIOMETRIC_STRONG).

• Encrypted Local Storage — Private key and passphrase are stored

in EncryptedSharedPreferences (hardware-backed AndroidKeyStore MasterKey).

Biometric compatibility mode for OEM stacks whose KeyStore does not stably support biometrically bound
AES keys.

SECURITY

Galaxit PWM is open-source and follows the Passbolt security model. The
server never has access to private keys, passphrases,

or plaintext secrets. TLS + certificate pinning in the release build, FLAG_SECURE
to prevent screenshot leaks in the vault, automatic screen lock after 5 minutes of inactivity.

CONTACT

[e-mail] · Galaxit ICT GmbH, Switzerland

What’s new

Bug Fixes MFA hat nicht funktiniert