npub1cnl......0s40hp

Alien Pass

Android
Android
npub1cnl......0s40hp

Alien Pass is a local, encrypted password manager. It runs fully offline — no cloud,
no server, no account, no telemetry. The app requests no INTERNET permission — only the two
normal permissions for the fingerprint sensor (USE_BIOMETRIC, USE_FINGERPRINT up to Android 8.1).
Your passwords never leave the device in plaintext.

Features:

  • Four entry types: logins (title, username, optional e-mail, password, URL, notes, TOTP), encrypted notes, cards
    (holder, number, expiry, CVV, PIN — masked, copyable) and bank accounts (holder, IBAN, BIC, bank, PIN); favourites; instant search
  • Extra fields, always secret (v1.4): up to eight freely named fields per entry (app PIN, phone password, security question …),
    revealed only on request, each with its own copy button — nothing has to sit in the notes in plain text
  • Categories like folders: filter chips above the list, suggestions from existing ones
  • Argon2id key derivation (32/64/128 MiB, self-benchmarked at setup) + AES-256-GCM via WebCrypto;
    a random data key is wrapped by your passphrase, file header authenticated (AAD)
  • Auto-lock after inactivity and in the background (immediately up to 5 min)
  • Clipboard auto-clear (15/30/60 s) — on timeout, on return to the app and on lock; copied content is flagged
    sensitive so the Android 13+ system preview hides it
  • Password generator: characters (8–64) and Diceware (EFF Large Wordlist), entropy shown — also right inside the entry form
    (panel under the password field, same settings as the generator tab)
  • TOTP per entry (RFC 6238, SHA-1/256/512, 6–8 digits) with remaining time
  • Password health: reused and short passwords flagged — computed locally; no forced rotation by age (NIST SP 800-63B)
  • Encrypted .vault backup and merge between devices (newer change wins, deletions carried for a year)
  • Import Proton Pass exports directly — PGP-encrypted (recommended), ZIP or JSON — with a small built-in
    OpenPGP reader (own AES block cipher, checked against FIPS-197 and WebCrypto in the test suite); vaults become categories, cards and notes come along,
    hidden custom fields become secret extra fields, a second e-mail address goes into the e-mail field
  • CSV import from KeePassXC, Bitwarden and Proton Pass (folders/groups become categories)
  • Optional Aegis hurdle: an extra TOTP code on unlock (honestly documented as a hurdle, not a second factor)
  • Optional fingerprint unlock (Android keystore, passphrase required after every restart, passphrase change or new fingerprint;
    honestly documented: any strong biometric of the device counts, with a confirmation tap)
  • No INTERNET permission; only USE_BIOMETRIC and USE_FINGERPRINT (up to Android 8.1) for the fingerprint sensor
    (plus the AndroidX-generated signature permission that grants nothing),
    FLAG_SECURE (no screenshots / recents preview), allowBackup=false + data extraction rules (no cloud, adb or D2D backup)
  • Strict CSP: connect-src 'none', no inline script; bundled Argon2 (hash-wasm) hash-checked in the build
  • German / English, offline in-app manual, open source (MIT)

Signing certificate SHA-256 (verify with AppVerifier), identical for every version:
73:C7:17:D8:05:6C:6A:02:B0:8B:AB:BA:24:18:17:F3:93:E4:6D:EA:03:19:D4:FA:26:B8:C3:D8:E1:F9:3C:95
apksigner (no separators): 73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95