1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
+++
title = "HardenedPass"
date = 2026-11-05T00:00:00Z
description = "HardenedPass is an Android client for pass, the standard Unix password manager: OpenPGP-encrypted files in a git repository, no Google Play Services, no telemetry."
draft = false
+++
{{< image src="/uppies/2026/11/hardenedpass-banner.png" alt="The HardenedPass banner: a shield-shaped padlock with a git branch cut through it, next to the app's name." />}}
I keep my passwords in [pass](https://www.passwordstore.org/): plain files, encrypted
with OpenPGP, in a git repository I host myself. On the phone I used Android Password
Store, until it was archived in October 2024. My phone runs GrapheneOS, I wanted a
client I could trust there, and I did not want to go shopping for a password manager
with a cloud. So I forked it.
HardenedPass picks up from upstream's last commit. The goal is simple: work flawlessly
on GrapheneOS, with no Google Play Services and no telemetry. All the credit for the
original work goes to the Android Password Store authors.
{{< actions url="https://github.com/danixland/HardenedPass/releases/latest" desc="Download the latest release" use="site" caption="HardenedPass is not on any app store. Get the APK from GitHub." >}}
{{< latest-release repo="danixland/HardenedPass" label="Latest release" >}}
## What is different from upstream
- Reads what modern GnuPG writes. Upstream rejected the OCB messages GnuPG 2.3 and later
produce by default.
- Rejects keys that have no encryption subkey when you import them.
- Updated cryptography libraries, fixing known advisories.
- Other apps can no longer reach the decrypt screen with arbitrary file paths.
- No crash reporting, no Google Play Services, one single FOSS build.
- A new interface, built with Jetpack Compose.
- Its own application ID: it installs next to upstream instead of over it.
## Where to start
- Never used `pass`? Start with [Concepts]({{< relref "/hardenedpass/getting-started/concepts" >}}).
- Have a store already? [Install]({{< relref "/hardenedpass/getting-started/install" >}}) the app, then [connect it]({{< relref "/hardenedpass/getting-started/connect" >}}).
{{< actions url="https://ko-fi.com/K6Y520C9I6" desc="Support on Ko-fi" use="site" >}}
The code is on [GitHub](https://github.com/danixland/HardenedPass), under the GPL-3.0.
Bugs and ideas go on the [issue tracker](https://github.com/danixland/HardenedPass/issues).
|
