Galaxit PWM

Galaxit PWM is the native Android client for the Galaxit password manager of the same name (pw.galaxit.ch). Designed for Swiss SMEs and security-conscious private users, the app is based on a strict zero-knowledge model: Your private PGP key never leaves your device; the server only sees the encrypted data.

WHAT THE APP CAN DO

• Locally decrypted vault — all logins, notes, time-based one-time passwords (TOTP), and passkeys are stored PGP-armored on the server and can only be read
with the passphrase on your device.

• System autofill service — Galaxit PWM integrates with Android autofill and suggests logins directly in other apps and browsers (Settings → Passwords, Passkeys & Accounts → Autofill service).


• Passkey Provider (Android 14+) — The app registers as a
CredentialProvider; FIDO2 authentication uses a locally stored
ECDSA P-256 key, signed per request via biometrics. WebAuthn compliant with
byte-accurate compatibility with Apple Passkeys and Galaxit Web Vault.

• Multi-Account — Any number of pwpw accounts can be used simultaneously, each with
its own PGP key, biometric profile, and tenant. A star
PIN is set for the default account upon app launch.

• Multi-QR Pairing — Setup via browser: pw.galaxit.ch displays an animated
QR sequence, which the app scans. The private key is transmitted exclusively
by the camera; the server only knows the SHA-512 hash.


• TOTP Generator — RFC-6238 with Base32 secret, 6 digits, 30-second rotation.

Built-in QR scanner for otpauth: codes.

• Cross-Device Approval — When you initiate a login on the desktop,

the confirmation request appears as a push notification on the phone;

Approval only with biometrics (BIOMETRIC_STRONG).

• Encrypted Local Storage — Private key and passphrase are stored

in EncryptedSharedPreferences (hardware-backed AndroidKeyStore MasterKey).

Biometric compatibility mode for OEM stacks whose KeyStore does not stably support biometrically bound
AES keys.

SECURITY

Galaxit PWM is open-source and follows the Passbolt security model. The
server never has access to private keys, passphrases,

or plaintext secrets. TLS + certificate pinning in the release build, FLAG_SECURE
to prevent screenshot leaks in the vault, automatic screen lock after 5 minutes of inactivity.

CONTACT

support@pw.galaxit.ch · Galaxit ICT GmbH, Switzerland