Stash: Passwords, Keys & 2FA

LabyrinthCode

About this app

Stash keeps the secrets you work with every day in one encrypted vault on your phone: env files, API keys, tokens, database URLs, SSH keys, logins and 2FA codes, for every project. It is built for developers and engineers, and it works fully offline until you choose to turn on sync.

ONE PLACE FOR EVERY SECRET
• Item types for logins, API keys, env files, URLs, SSH keys, database connections, notes and 2FA
• Folders for each project or environment, such as prod, staging or personal
• Tags and a search across every key, URL and note
• Secrets are masked in lists and need a tap to reveal

COPY IN ONE TAP
Copy a key, a password or a whole env file. Copies are marked sensitive, so Android hides them from clipboard previews, and Stash clears the clipboard after 30 seconds, or the time you choose.

2FA CODES NEXT TO THE LOGIN
• Time-based codes shown right beside the login they belong to
• Add a code by scanning a QR or typing the key
• Import your accounts from a Google Authenticator export

AUTOFILL
Fill logins in other apps and websites, matched by app ID or URL, and save new logins as you sign in. A login can keep several URLs, sites that share one sign-in (google.com and youtube.com, say) match each other, and a login's 2FA code is copied right after it fills.

VAULT HEALTH
Find reused, weak and duplicate passwords, and keep one copy of a duplicate in a tap. The optional breach check asks Have I Been Pwned with only the first 5 characters of a password hash; it stays off until you turn it on.

PASSWORD GENERATOR
Random passwords from 8 to 64 characters, or passphrases of 3 to 10 words from the EFF wordlist.

OFFLINE FIRST
Stash works without a network and sends nothing anywhere until you turn on sync (or the optional breach check, which sends only 5 characters of a password hash). There is no Stash account, no Stash server, no analytics, no ads and no tracking. Your phone's own encrypted backup can include the vault, still locked by your passphrase.

OPTIONAL END-TO-END ENCRYPTED SYNC
Turn on sync to keep your phones and the Stash browser extension in step through a hidden app folder in your own Google Drive. Your vault is encrypted on the device with a key locked by your passphrase before it leaves, so Google only ever stores ciphertext. Stash can't see your other Drive files. If two devices change the same item offline, the losing version is kept in the trash, so nothing is lost.

ENCRYPTED
• The vault is encrypted with AES-256, using a key derived from your passphrase with Argon2id
• Your passphrase is never stored. Without it the vault cannot be read, and it cannot be recovered
• Optional fingerprint or face unlock
• Auto-lock after the time you choose
• Screenshots and the recent apps preview are blocked by default

BACKUPS YOU CONTROL
Write encrypted backups or exports to any folder you pick, including a cloud folder of your choice. A backup opens on any device with your passphrase.

BRING YOUR PASSWORDS
Import from Google Password Manager, Chrome, Bitwarden, 1Password, Apple Passwords or KeePassXC, from their export file or straight from the other app. Export to Bitwarden JSON or Google CSV when you move on.

ALSO
• Trash keeps deleted items for 30 days
• Dark and light themes, or follow the system
• A terminal-style interface, made to be fast to scan

What’s new

Release v1.3.0
• Optional end-to-end encrypted sync through your own Google Drive, shared with your other phones and Stash for Chrome
• Import from Google, Bitwarden, 1Password, Apple Passwords or KeePassXC; export to Bitwarden or Google
• Vault health finds reused, weak and duplicate passwords, plus an opt-in breach check
• Several URLs per login, and sites that share one login
• The 2FA code is copied right after autofill
• Folders go to the trash, restorable for 30 days
• Fixes and polish