TheCode — Password Manager

Jul SQL

About this app

TheCode is a password manager that stores no passwords. Each one is recomputed on your phone, on demand, from a master key only you know and the site's name.

━━━━━━━━━━━━━━━━━━━━━
ONE KEY. ONE PASSWORD PER SITE.
━━━━━━━━━━━━━━━━━━━━━

→ Same key + same site = exactly the same password, every time, on every device.
→ Different sites = unrelated passwords.
→ Nothing to steal: no password is saved, neither on the phone nor on a server.

The derivation (PBKDF2 with 600,000 iterations, then HMAC-SHA256) is documented, tested and reproducible: your passwords do not depend on any service staying alive.

━━━━━━━━━━━━━━━━━━━━━
FEATURES
━━━━━━━━━━━━━━━━━━━━━

• Android autofill: TheCode offers the password inside apps and web pages, with the account's username
• Vault: keep each site's username, length and characters — never the password
• Save suggestions: a new site is offered to the vault
• Vault lock with biometrics or your master key
• Password masked by default, revealed with one tap
• Length from 4 to 40 characters; lowercase, uppercase, digits, symbols
• Default settings remembered, and shared across your devices with an account
• Move your vault to another device with an encrypted QR code
• Optional automatic sync, end-to-end encrypted
• Sign in with Google or with an email address
• Dark, light or system theme
• No ads, no trackers, no analytics

━━━━━━━━━━━━━━━━━━━━━
PRIVACY
━━━━━━━━━━━━━━━━━━━━━

• Your master key never leaves your phone. It is encrypted there by the Android Keystore.
• Without an account, the app contacts no server: everything works offline.
• With an account, the vault is encrypted on the phone before it leaves: the server sees neither your sites nor your usernames.
• The camera is only used to read a transfer QR code; no image is saved.
• Open source under the Apache 2.0 licence: everything can be checked.

━━━━━━━━━━━━━━━━━━━━━
EVERYWHERE, WITH THE SAME KEY
━━━━━━━━━━━━━━━━━━━━━

• Android app (you are here)
• iPhone, iPad and Mac apps
• Extensions for Chrome, Firefox, Edge and Brave
• Website thecode.julsql.fr

The same key gives you the same passwords on each of them, even without sync.

━━━━━━━━━━━━━━━━━━━━━
FREE
━━━━━━━━━━━━━━━━━━━━━

Generation, the vault and autofill are free and unlimited, with no ads.

━━━━━━━━━━━━━━━━━━━━━
HOW IT WORKS
━━━━━━━━━━━━━━━━━━━━━

1. Pick a long master key and remember it: it cannot be recovered.
2. Type a site (e.g. "google.com") and, if needed, the username.
3. The password appears. Copy it, or let autofill insert it.

Later, on any device: same key, same site → same password.

What’s new

• New password algorithm (v2): migrate your passwords site by site. The previous one (v1) remains available for one-off generation
• Vault lock: biometrics or your master key
• v2 vault with a username per account
• Autofill with the username
• Offer to add a new site to the vault
• Password masked by default
• Automatic, end-to-end encrypted sync
• Default settings shared across devices
• Sign in with Google