HardenedPass

I keep my passwords in pass: plain files, encrypted with OpenPGP, in a git repository I host myself. On the phone I used Android Password Store, until it was archived in October 2024. My phone runs GrapheneOS, I wanted a client I could trust there, and I did not want to go shopping for a password manager with a cloud. So I forked it.

HardenedPass picks up from upstream’s last commit. The goal is simple: work flawlessly on GrapheneOS, with no Google Play Services and no telemetry. All the credit for the original work goes to the Android Password Store authors.

// What is different from upstream

• Reads what modern GnuPG writes. Upstream rejected the OCB messages GnuPG 2.3 and later produce by default.
• Rejects keys that have no encryption subkey when you import them.
• Updated cryptography libraries, fixing known advisories.
• Other apps can no longer reach the decrypt screen with arbitrary file paths.
• No crash reporting, no Google Play Services, one single FOSS build.
• A new interface, built with Jetpack Compose.
• Its own application ID: it installs next to upstream instead of over it.

// Where to start

• Never used pass? Start with Concepts.
• Have a store already? Install the app, then connect it.

The code is on GitHub, under the GPL-3.0. Bugs and ideas go on the issue tracker.