CardHolder keeps your credit and debit card details on your phone — encrypted,
locked behind a passphrase, and completely offline.

Most "secure" apps ask you to trust a promise not to upload your data.
CardHolder cannot upload it. The app requests no internet permission at all, so
Android itself refuses it a network connection. That is a property of the
installed app, not a policy you have to take on faith.

WHAT IT DOES

• Store card number, expiry, security code, cardholder name and a private note
• Automatic network detection — Visa, Mastercard, American Express, Discover,
Diners Club, JCB, UnionPay, RuPay and Maestro, each formatted the way it is
printed on the plastic
• Checksum validation catches a mistyped digit before you save it
• Eight card finishes, so your wallet on screen looks like your wallet in your pocket
• Numbers stay masked until you tap to reveal
• Copy a number safely — the clipboard clears itself after 45 seconds

HOW IT IS PROTECTED

• AES-256-GCM authenticated encryption. A tampered vault is detected, not
silently decrypted into wrong digits.
• Your passphrase is stretched with PBKDF2-HMAC-SHA256 over 210,000 iterations.
• The result is sealed a second time by a key held in your phone's secure
hardware — a key that physically cannot be exported. Someone who copies the
files off your phone still cannot attack them anywhere else.
• Optional fingerprint unlock, bound to your current enrolled fingerprints.
Adding a new fingerprint destroys the key rather than granting it access.
• The vault locks the moment you leave the app, and the decryption key is wiped
from memory — not merely hidden behind a screen.
• Screenshots, screen recording and the app preview in the recent-apps switcher
are all blocked.
• Wrong passphrase attempts trigger an escalating cool-off, with an optional
self-erase after ten failures.

NO ACCOUNT. NO ANALYTICS. NO ADS.

There is no sign-up, no cloud sync, no telemetry and no advertising. Backups are
switched off, so your vault is never copied to Google Drive or transferred to a
new phone. Nothing about your cards is readable by any other app on the device.

PLEASE READ

Because there is no account and no cloud copy, there is no password reset and no
recovery. If you forget your passphrase, the data is gone — that is the direct
consequence of nobody but you holding the key. Choose something you will
remember.

CardHolder is not affiliated with, endorsed by, or connected to Visa,
Mastercard, American Express, or any other card network or bank. Network names
are shown only to identify your own cards.