Documentation
On this page
Security
This page says what the app does for you and, just as important, what it does not do.
Where your secrets live
| Secret | Where it is | How it is protected |
|---|---|---|
| Entries | Files in the app’s private storage, and on your git server | OpenPGP, the same as pass on a computer |
| OpenPGP private key | The app’s private storage | Its own passphrase |
| Key passphrase | Nowhere, unless you enable caching | If cached: AES-GCM under an Android Keystore key |
| Git and proxy passwords | The app’s private storage, if you tell it to remember them | AES-GCM under an Android Keystore key |
| SSH key made on the phone | Android Keystore | The system, plus your screen lock if you ask for it |
| SSH key you imported | The app’s private storage | Its own passphrase, if it has one |
Android Keystore keys are held by the system and cannot be copied out of the phone, even by the app that uses them.
What the app does
- No telemetry. No analytics, no crash reports, no Google Play Services. The app only connects to the git server you configured, and to your proxy if you set one.
- Blocks screenshots of secrets. Entries, the editor, the generator, passphrase dialogs and autofill windows cannot be captured by screenshots, and do not appear in the recent apps view.
- Clears the clipboard. A copied password is removed after a timeout.
- Checks the SSH server. The server’s host key is saved on first connection and checked after that. The first connection is trusted without asking, so make it on a network you trust.
- Trusts known browsers only. Autofill works only in browsers whose signing certificate the app recognizes, and warns you if an app’s publisher changes. See Autofill.
- Refuses outside files. Other apps can open the app, but it only opens paths that really are inside your store.
What the app does not protect you from
- A compromised phone. Malware that controls an unlocked phone can see what you see. Keep the system up to date.
- Your keyboard. A keyboard app sees everything you type, the passphrase included. Use one you trust, with network access off if your system allows that.
- Other apps reading the clipboard before the timeout runs out. Autofill avoids the clipboard altogether.
- A weak passphrase. If someone gets your key file, the passphrase is all that is left.
- Your git server seeing names. Entry and folder names are file names, and they are not encrypted, so the server can read them, along with the dates of your commits.
- Biometric lock as encryption. Enable biometric authentication is a gate at app start. It keeps out someone holding your unlocked phone for a moment, and it does not encrypt anything.
- Losing your key. No one can recover a store without its private key and passphrase.
Passphrase caching
Caching is convenient, but while the passphrase is cached, anyone who gets into the unlocked app can open every entry. It is experimental. If you use it, turn on Automatically clear passphrase cache as well.