Credentials: Password Manager

Credentials is a local-first, zero-knowledge password manager designed for users who want total ownership and uncompromising security over their sensitive digital credentials.

Unlike cloud-based password managers that store your vaults on remote servers, Credentials operates entirely on your physical device. It requires zero internet permissions, meaning your passwords, usernames, and notes never leave your phone.

SECURE LOCAL ARCHITECTURE
• 100% Offline by Design: No remote servers, no cloud databases, and no network access.
• Authenticated AES-256-GCM Encryption: Every sensitive field (passwords, usernames, custom fields, notes) is encrypted with AES-256-GCM with unique cryptographic initialization vectors (IV/nonce).
• Hardware-Backed Android Keystore: Cryptographic keys are protected using your device’s secure hardware (TEE / StrongBox where supported).
• Zero-Knowledge Master Password: Your master password derives vault encryption keys via PBKDF2-HMAC-SHA256 with high-iteration stretching. Your master password is never stored anywhere on the device.

AUTHENTICATION & ACCESS CONTROL
• Biometric Unlock: Unlock your vault quickly and securely using your fingerprint or facial recognition.
• Secure 6-to-8 Digit Master PIN: Protected against brute-force attacks with rate-limiting and progressive lockout delays.
• Configurable Auto-Lock: Automatically lock the vault immediately upon backgrounding, or after 30 seconds, 1 minute, 5 minutes, or 15 minutes.

ENCRYPTED BACKUP & RESTORE
• Secure .vault Backup: Export an authenticated, encrypted backup file protected with a dedicated backup passphrase.
• Tamper-Proof: Decryption verifies integrity with AES-GCM authentication tags, rejecting corrupted or tampered files.
• Zero Plaintext Exposure: Plaintext JSON exports are strictly disabled. Your data is only ever exported in encrypted form.

DEVICE & PRIVACY SAFEGUARDS
• Screenshot & Screen Recording Protection: Android WindowManager FLAG_SECURE prevents unauthorized screenshots or screen capture on sensitive screens.
• Automatic Clipboard Clearing: Copied passwords are cleared from the clipboard automatically after a customizable interval (default 30 seconds).
• Secure Password Generator: Built-in high-entropy password generator utilizing cryptographically secure randomness (SecureRandom).
• Organized Categories & Custom Fields: Sort credentials by category (Logins, Cards, Secure Notes, Identity) and attach encrypted custom key-value attributes.

ZERO DATA COLLECTION
Credentials contains no advertising SDKs, no analytics trackers, no crash-reporting telemetries, and no third-party integrations. You retain 100% ownership of your vault.