Install

HardenedPass needs Android 12 or newer and works without Google Play Services. It is not on an app store: you install the APK from the project’s releases.

// Download

Open the latest release and download both files:

• HardenedPass_vX.Y.Z.apk, the app
• HardenedPass_vX.Y.Z.apk.sha256, its checksum

// Verify the download

This step needs a computer, and it is worth doing: a password manager is a bad thing to install from a tampered file.

Check that the file arrived intact:

1

sha256sum -c HardenedPass_vX.Y.Z.apk.sha256

The output must end in OK.

Then check who signed it. apksigner is part of the Android SDK build tools:

1

apksigner verify --print-certs HardenedPass_vX.Y.Z.apk

The certificate SHA-256 digest line must read:

1

725016669e482f9ac371dee8df19a2a1b34fa76d1af05b2a23784725b1b49c83

If either check fails, do not install the file.

// Install

Copy the APK to the phone and open it from the file manager. Android asks you to allow installs from that app the first time. Allow it, install, then turn the permission off again if you prefer.

HardenedPass has its own application ID, so it installs next to Android Password Store instead of replacing it. The two share no data: to move over, set HardenedPass up as described in Connect the app.

// Update

The app does not check for updates. To follow new versions, watch the releases page or its Atom feed.

To update, verify the new APK the same way and install it over the old one. Your store and keys stay in place. Android refuses an update signed with a different key, which is one more check on top of yours.