# HardenedPass

![HardenedPass](media/banner.png)

An Android client for [pass](https://www.passwordstore.org/), the standard Unix password manager.
Passwords are stored as OpenPGP-encrypted files in a git repository, so the same store works with
`pass` on the desktop and with this app on the phone. HardenedPass aims to work flawlessly on
GrapheneOS: it needs no Google Play Services and sends no telemetry.

This is a maintained fork of
[android-password-store/Android-Password-Store](https://github.com/android-password-store/Android-Password-Store),
which was archived in October 2024. All credit for the original work goes to the
Android Password Store authors.

## Documentation

How to install, set up and use the app: <https://danix.xyz/hardenedpass/>.

New to `pass`? "Your own password store" is a beginner tutorial series, also available in
[Italian](https://danix.xyz/it/articles/your-own-password-store-part-1/):

1. [Create the store](https://danix.xyz/articles/your-own-password-store-part-1/) with `pass`,
   GPG and git.
2. [Choose a git host](https://danix.xyz/articles/your-own-password-store-part-2/), or do it all
   from the phone with Termux.
3. [Install HardenedPass](https://danix.xyz/articles/your-own-password-store-part-3/), connect it
   to the store, and cover daily use and recovery.

## Changes from upstream

- Decrypts messages GnuPG 2.3+ writes by default (OCB / LibrePGP AEAD), which upstream rejected
  as "non-standard AEAD".
- Rejects keys without an encryption-capable subkey on import.
- Bouncy Castle 1.86 and PGPainless 1.7.8, fixing known Bouncy Castle advisories.
- Decrypt screen no longer reachable by other apps with arbitrary file paths.
- No build scans uploaded to third-party services.
- No crash reporting (Sentry) and no Google Play Services; a single FOSS build.
- Needs Android 12 or later.
- Own application ID (`xyz.danix.hardenedpass`): installs next to upstream instead of over it.

## Building

Requires JDK 17 and the Android SDK command-line tools. Point Gradle at the SDK with a
`local.properties` file (`sdk.dir=/path/to/Android/Sdk`), then:

```
./gradlew :app:assembleDebug     # APK in app/build/outputs/apk/debug/
./gradlew test -PslimTests       # unit tests
```

The app has no proprietary dependencies: no crash reporting, no telemetry, no Google Play
Services.

## Issues

Report bugs and feature requests on the
[issue tracker](https://github.com/danixland/HardenedPass/issues).

## Support

HardenedPass will always be free, but maintaining a software can be costly, so if you found this piece of software useful, you can buy me a coffee.
All donations will help me maintain HardenedPass in the future.

[![Support on Ko-fi](media/kofi-button.png)](https://ko-fi.com/K6Y520C9I6)

## License

GPL-3.0-only, see [LICENSE.txt](LICENSE.txt).

Copyright © 2014-2024 The Android Password Store Authors.
Modifications Copyright (C) 2026 Danilo M. <danix@danix.xyz>.

## Development Approach

This project is developed using AI-assisted tools. Code is generated with the help of AI based on human-provided specifications, design decisions, and iterative feedback.

All contributions are reviewed, tested, and curated by the maintainer before being included in the codebase. AI is used as a productivity and exploration tool, while human oversight remains central to all decisions.

The goal is to combine the flexibility of AI-assisted development with standard open-source practices such as transparency, review, and accountability.