+++
title = "HardenedPass"
date = 2026-11-05T00:00:00Z
description = "HardenedPass is an Android client for pass, the standard Unix password manager: OpenPGP-encrypted files in a git repository, no Google Play Services, no telemetry."
draft = false
+++

{{< image src="/uppies/2026/11/hardenedpass-banner.png" alt="The HardenedPass banner: a shield-shaped padlock with a git branch cut through it, next to the app's name." />}}

I keep my passwords in [pass](https://www.passwordstore.org/): plain files, encrypted
with OpenPGP, in a git repository I host myself. On the phone I used Android Password
Store, until it was archived in October 2024. My phone runs GrapheneOS, I wanted a
client I could trust there, and I did not want to go shopping for a password manager
with a cloud. So I forked it.

HardenedPass picks up from upstream's last commit. The goal is simple: work flawlessly
on GrapheneOS, with no Google Play Services and no telemetry. All the credit for the
original work goes to the Android Password Store authors.

{{< actions url="https://github.com/danixland/HardenedPass/releases/latest" desc="Download the latest release" use="site" caption="HardenedPass is not on any app store. Get the APK from GitHub." >}}

{{< latest-release repo="danixland/HardenedPass" label="Latest release" >}}

## What is different from upstream

- Reads what modern GnuPG writes. Upstream rejected the OCB messages GnuPG 2.3 and later
  produce by default.
- Rejects keys that have no encryption subkey when you import them.
- Updated cryptography libraries, fixing known advisories.
- Other apps can no longer reach the decrypt screen with arbitrary file paths.
- No crash reporting, no Google Play Services, one single FOSS build.
- A new interface, built with Jetpack Compose.
- Its own application ID: it installs next to upstream instead of over it.

## Where to start

- Never used `pass`? Start with [Concepts]({{< relref "/hardenedpass/getting-started/concepts" >}}).
- Have a store already? [Install]({{< relref "/hardenedpass/getting-started/install" >}}) the app, then [connect it]({{< relref "/hardenedpass/getting-started/connect" >}}).

{{< actions url="https://ko-fi.com/K6Y520C9I6" desc="Support on Ko-fi" use="site" >}}

The code is on [GitHub](https://github.com/danixland/HardenedPass), under the GPL-3.0.
Bugs and ideas go on the [issue tracker](https://github.com/danixland/HardenedPass/issues).