aboutsummaryrefslogtreecommitdiffstats

HardenedPass

An Android client for pass, the standard Unix password manager. Passwords are stored as OpenPGP-encrypted files in a git repository, so the same store works with pass on the desktop and with this app on the phone. HardenedPass aims to work flawlessly on GrapheneOS: it needs no Google Play Services and sends no telemetry.

This is a maintained fork of android-password-store/Android-Password-Store, which was archived in October 2024. All credit for the original work goes to the Android Password Store authors.

Changes from upstream

  • Decrypts messages GnuPG 2.3+ writes by default (OCB / LibrePGP AEAD), which upstream rejected as "non-standard AEAD".
  • Rejects keys without an encryption-capable subkey on import.
  • Bouncy Castle 1.86 and PGPainless 1.7.8, fixing known Bouncy Castle advisories.
  • Decrypt screen no longer reachable by other apps with arbitrary file paths.
  • No build scans uploaded to third-party services.
  • No crash reporting (Sentry) and no Google Play Services; a single FOSS build.
  • Own application ID (xyz.danix.hardenedpass): installs next to upstream instead of over it.

Building

Requires JDK 17 and the Android SDK command-line tools. Point Gradle at the SDK with a local.properties file (sdk.dir=/path/to/Android/Sdk), then:

./gradlew :app:assembleDebug     # APK in app/build/outputs/apk/debug/
./gradlew test -PslimTests       # unit tests

The app has no proprietary dependencies: no crash reporting, no telemetry, no Google Play Services.

Issues

Report bugs and feature requests on the issue tracker.

License

GPL-3.0-only, see LICENSE.txt.

Copyright © 2014-2024 The Android Password Store Authors. Modifications Copyright (C) 2026 Danilo M. danix@danix.xyz.

Development Approach

This project is developed using AI-assisted tools. Code is generated with the help of AI based on human-provided specifications, design decisions, and iterative feedback.

All contributions are reviewed, tested, and curated by the maintainer before being included in the codebase. AI is used as a productivity and exploration tool, while human oversight remains central to all decisions.

The goal is to combine the flexibility of AI-assisted development with standard open-source practices such as transparency, review, and accountability.