Keyholm
keyholm/keyholm
Install Keyholm
Download Zapstore
Download
- Scan the code with your phone’s camera
- Tap Download anyway if the browser warns about the file
- Allow your browser to install unknown apps if Android asks
- Open Zapstore and finish the onboarding
Open Keyholm in Zapstore
Open
- Scan the code to open Keyholm in Zapstore, or search for it there
- Tap Install, and Download if Zapstore asks you to confirm the developer
- Confirm in Android’s install dialog. Allow Zapstore to install unknown apps if Android asks
Unclaimed app
The catalog lists Keyholm from
keyholm/keyholm
and signs its releases. The developer has not claimed it.
The file is still checked before you install it.
Are you the developer? Cryptographically prove you hold the key that signs it.
Manages single-device passkeys protected by secure hardware. Creates client-side discoverable credentials that cannot be exported or synced, acting as a built-in security key for your phone.
Keyholm is all about single-device passkeys (i.e. client-side discoverable credentials) whose private key is protected by secure hardware.
You can never export or sync these passkeys. Think of Keyholm as a way to activate the built-in security key on your phone.
target devices: phones with secure hardware (including Pixels)
no INTERNET permission
no Google Play Services ever
takes advantage of latest Android version/APIs
allows extensive control over particulars of what credentials it creates and how
supports ES256: it's the only EC, StrongBox-backed algorithm
supports Ed25519: it's not NIST, it's fast and safe but TEE-only
supports ML-DSA: post-quantum! but Android 17 and TEE-only
supports android-key attestation
supports PRF extension
uses QUERY_ALL_PACKAGES in order to display icons for apps that were denied passkey usage
account list export/import for making it marginally easier to switch devices. All keys still need to be manually recreated on the new device!
Summary generated by Zapstore from source.
Original description, as the developer published it.
Latest release
The catalog lists this app from
keyholm/keyholm
and signs its releases. The developer has not claimed it.
Are you the developer? Claim your app
Sees all installed apps has no shown use.
Permissions
- Installed apps QUERY_ALL_PACKAGES See every app installed on this phone Sees all installed apps has no shown use.
Uses biometric authentication to unlock passkeys.
Release notes
What's Changed
Keyholm now guarantees app data backwards compatibility, starting with this version's.
WARNING: If you're upgrading from v0.0.4 or below and don't want to lose your data, you must upgrade to v0.0.5 first to migrate! Keyholm only supports encrypted at rest data from now on.
Otherwise there are just small UX improvements in this release.
Full Changelog: https://github.com/keyholm/keyholm/compare/v0.0.5...v0.1.0
Artifacts
keyholm.apk |
the release APK, signed with the release key |
keyholm-unsigned.apk |
the reproducible build output, before signing |
keyholm-unsigned.apk.sigstore.json |
keyless Sigstore bundles proving the APK was produced by this workflow |
keyholm.apk.sigstore.json |
keyless Sigstore bundles proving the APK was verified by this workflow |
The signed APK's ZIP payload is byte-identical to keyholm-unsigned.apk.
Only the APK Signing Block differs. See the workflow run for the recorded SHA-256 of each.
Verify provenance
Install cosign:
SHA=54303ca266a4d8ea2187da90d2632536fe33edc5
# Or if you have a local clone
# SHA=$(git rev-parse "v0.1.0^{commit}")
gh release download v0.1.0
cosign verify-blob \
--bundle keyholm.apk.sigstore.json \
--certificate-identity-regexp '^https://github\.com/keyholm/keyholm/\.github/workflows/release\.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-sha $SHA \
keyholm.apk
cosign verify-blob \
--bundle keyholm-unsigned.apk.sigstore.json \
--certificate-identity-regexp '^https://github\.com/keyholm/keyholm/\.github/workflows/release\.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-sha $SHA \
keyholm-unsigned.apk
Both APKs also have build provenance attestations:
gh attestation verify keyholm.apk \
--repo keyholm/keyholm \
--signer-workflow keyholm/keyholm/.github/workflows/release.yml \
--source-digest $SHA
gh attestation verify keyholm-unsigned.apk \
--repo keyholm/keyholm \
--signer-workflow keyholm/keyholm/.github/workflows/release.yml \
--source-digest $SHA
Verify the APK signature
apksigner verify --print-certs -v keyholm.apk
Verify reproducibility
git checkout v0.1.0
mise install
mise exec -- gradle assembleRelease
sha256sum keyholm-unsigned.apk app/build/outputs/apk/release/keyholm-unsigned.apk
Comments
Loading comments…
More password & 2fa apps
See more-
P
Password Store
Manage your passwords & passkeys
-
P
PaperCript
Encrypted passwords on printable QR cards. No network, stores nothing.
-
M
Monica
Open-source password manager: local encryption, autofill, TOTP, Passkey
-
P
Proton Pass
Password manager created by the scientists who met at CERN behind Proton Mail.
-
Y
Yubico Authenticator
Generate OATH codes with YubiKey NEO over NFC
-
T
Tokn
Open-source 2FA authenticator. Encrypted on-device. No accounts.
Get Keyholm the private way
Updates checked on your device, and every release verified before it installs.