1Key Password Manager Pengurus Kata Laluan aplikasi untuk Android deskripsi
1Key is a local-first password manager for Android. Your vault lives on your device, encrypted with a key only you hold, and never moves unless you export it yourself. There is no account to create, no server to breach, and no network connection of any kind — the INTERNET permission is stripped from the manifest, so the operating system itself enforces the offline guarantee.
Security
- Vault key derived from your master password with Argon2id (m=64 MiB, t=3, p=1 by default; configurable up to m=256 MiB, t=16)
- Every credential field encrypted separately with AES-256-GCM, bound to its row and column via additional authenticated data — an attacker with raw database write access cannot swap ciphertexts between rows
- Master-password verifier stored in EncryptedSharedPreferences, itself wrapped by an Android Keystore-bound key (TEE or StrongBox where available), so offline brute-force of a leaked device image is not possible
- Optional 128-bit Secret Key mixed into the KDF for defense-in-depth against a compromised master password
- Biometric unlock backed by hardware-secure key; requires master-password confirmation to enable
- Tiered attempt limiting: 3, 5, and 10 wrong attempts trigger 30-second, 5-minute, and 1-hour cooldowns; counters survive process kills
Vault
- Store credentials with title, username, password, URL, notes, and custom fields
- Tag-based organisation, favourites, full-text search
- TOTP / 2FA codes stored in the same entry as the password they protect — no app switching
- Live-preview Markdown in notes with a helper bar; disable in Settings if you prefer plain text
- Soft-delete recycle bin (toggle off if you prefer immediate deletion)
- Credential history preserves previous values on edit
Autofill
- System-level Autofill Service — fill logins into any app or browser without leaving them
- URL-only matching by default (no fuzzy suggestions) to keep phishing risk down
- Save prompt on submit; per-action confirmation for cross-host URL saves
Backup and import
- Encrypted backup as a .1key file (AES-256-GCM with Argon2id key derivation)
- Plain CSV / JSON export for interoperability
- Direct import from Google Passwords, LastPass, KeePass, 1Password, Dashlane, NordPass, Safari / iCloud Keychain — auto-detects format, no manual column mapping
Unlock options
- Master password (always available)
- 6-digit PIN
- Biometric (fingerprint / face)
- Background auto-lock: immediate / 30s / 1m / 5m
- Inactivity auto-lock: never / 30s / 1m / 5m / 15m
- Optional periodic master-password recheck (48h / 3d / 1w / 3w)
What 1Key does NOT do
- No accounts, no email, no signup
- No analytics, crash reporting, or telemetry
- No cloud sync (backup files go to a folder you choose — local, USB, Drive, Dropbox, NAS — never through us)
- No device identifiers, IP logging, or advertising IDs
- No network connection at all — INTERNET permission is stripped
Anti-features
The QR-scanning and OCR features use Googles ML Kit library, which contains proprietary code. All ML Kit processing happens on-device with the INTERNET permission stripped, so no data can leave the phone even if the library tried to phone home — but F-Droid still flags the dependency as NonFreeDep. If you want a fully libre build, you can build from source without ML Kit.
Open source
Source: https://github.com/roufsyed/1Key
Licence: GPL-3.0-or-later
Reproducible builds: yes
Built because paying $48/year to autofill a password should not be a thing.
