PocketVault is an open-source password manager that works locally on your Android device. It does not request Internet permission and contains no advertising, analytics, telemetry, or crash-reporting SDK. There is no PocketVault account, cloud service, or remote backend.

Main features

• Store passwords, login details, secure notes, categories, favorites, and encrypted attachments
• Add TOTP accounts manually or scan QR codes locally with optional camera access
• Search locally and organize entries with categories, list, and grid views
• Generate configurable passwords and passphrases
• Unlock conveniently with Android biometrics
• Import and export encrypted backups, with up to five automatic safety backups
• Protect sensitive screens, lock automatically in the background, and clear copied secrets after 60 seconds
• Use light or dark themes in seven interface languages

Security design

Vault content is encrypted with Google Tink Streaming AEAD using AES-256-GCM-HKDF. A random vault key is protected by a key derived from your master password with PBKDF2-HMAC-SHA256. New vaults use 600,000 PBKDF2 iterations.

Your master password is not stored. Biometric unlock is an optional convenience protected by Android Keystore and does not replace the master password.

Your data stays under your control

Vault data is encrypted and processed on your device. Data leaves the app only when you explicitly export or share a backup through an Android system destination. PocketVault cannot access your vault or recover a forgotten master password.

Open source

The source code, security model, build instructions, and issue tracker are publicly available through the developer website. PocketVault is released under the Apache License 2.0.

Important information

Open-source code and offline operation reduce risk but do not guarantee absolute security.

Use a strong master password, keep it safe, and protect exported backups. Older backups require the password that was used when they were created.