1Key

about

description

1Key is a local-first password manager for Android. Your vault lives on your device, encrypted with a key only you hold, and never moves unless you export it yourself. There is no account to create, no server to breach, and no network connection of any kind — the INTERNET permission is stripped from the manifest, so the operating system itself enforces the offline guarantee. **Security** • Vault key derived from your master password with Argon2id (m=64 MiB, t=3, p=1 by default; configurable up to m=256 MiB, t=16) • Every credential field encrypted separately with AES-256-GCM, bound to its row and column via additional authenticated data — an attacker with raw database write access cannot swap ciphertexts between rows • Master-password verifier stored in EncryptedSharedPreferences, itself wrapped by an Android Keystore-bound key (TEE or StrongBox where available), so offline brute-force of a leaked device image is not possible • Optional 128-bit Secret Key mixed into the KDF for defense-in-depth against a compromised master password • Biometric unlock backed by hardware-secure key; requires master-password confirmation to enable • Tiered attempt limiting: 3, 5, and 10 wrong attempts trigger 30-second, 5-minute, and 1-hour cooldowns; counters survive process kills **Vault** • Store credentials with title, username, password, URL, notes, and custom fields • Tag-based organisation, favourites, full-text search • TOTP / 2FA codes stored in the same entry as the password they protect — no app switching • Live-preview Markdown in notes with a helper bar; disable in Settings if you prefer plain text • Soft-delete recycle bin (toggle off if you prefer immediate deletion) • Credential history preserves previous values on edit **Autofill** • System-level Autofill Service — fill logins into any app or browser without leaving them • URL-only matching by default (no fuzzy suggestions) to keep phishing risk down • Save prompt on submit; per-action confirmation for cross-host URL saves **Backup and import** • Encrypted backup as a .1key file (AES-256-GCM with Argon2id key derivation) • Plain CSV / JSON export for interoperability • Direct import from Google Passwords, LastPass, KeePass, 1Password, Dashlane, NordPass, Safari / iCloud Keychain — auto-detects format, no manual column mapping **Unlock options** • Master password (always available) • 6-digit PIN • Biometric (fingerprint / face) • Background auto-lock: immediate / 30s / 1m / 5m • Inactivity auto-lock: never / 30s / 1m / 5m / 15m • Optional periodic master-password recheck (48h / 3d / 1w / 3w) **What 1Key does NOT do** • No accounts, no email, no signup • No analytics, crash reporting, or telemetry • No cloud sync (backup files go to a folder you choose — local, USB, Drive, Dropbox, NAS — never through us) • No device identifiers, IP logging, or advertising IDs • No network connection at all — INTERNET permission is stripped **Anti-features** The QR-scanning and OCR features use Google's ML Kit library, which contains proprietary code. All ML Kit processing happens on-device with the INTERNET permission stripped, so no data can leave the phone even if the library tried to phone home — but F-Droid still flags the dependency as NonFreeDep. If you want a fully libre build, you can build from source without ML Kit. **Open source** Source: https://github.com/roufsyed/1Key Licence: GPL-3.0-or-later Reproducible builds: yes Built because paying $48/year to autofill a password should not be a thing.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-08T19:35:29.419904+00:00

last event

2026-10-12 22:14 UTC

website

https://roufsyed.github.io/1Key/

install

zapstore.dev or any Zapstore-compatible client

topics

#password & 2fa #security

source & build

repository

https://github.com/roufsyed/1key

arch flags

android-arm64-v8a

manifest

missing

releases (kind 30063)

2 releases indexed; latest 1.1.2.

version	channel	released	event
1.1.2	main	2026-10-12 22:14 UTC	849405eb…
1.1.1	main	2026-07-10 09:44 UTC	a85197e0…

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

1.1.2 — 1Key_full_1.1.2_4_arm64-v8a_release.apk

sha256

181f61aa41e5fba9b5250dc717b91da5a19a52daed1f61ab706d40da5cbdb933

size

17.1 MB

archs

android-arm64-v8a

version code

4

apk cert sha256

12035293daabc95bba142e0deebab9ec36dfcb85e30a0f1f83bd7005cdea41f6

download

1Key_full_1.1.2_4_arm64-v8a_release.apk

1.1.1 — 1Key_full_1.1.1_3_arm64-v8a_release.apk

sha256

8e3c3cc99c066db0d5e26f82ac7f3d482a35982b2889027c6e18464437fd5b25

size

15.9 MB

archs

android-arm64-v8a

version code

3

apk cert sha256

12035293daabc95bba142e0deebab9ec36dfcb85e30a0f1f83bd7005cdea41f6

download

1Key_full_1.1.1_3_arm64-v8a_release.apk

Showing the newest 2 asset descriptors; the full set is in /api/apps/78ce6faa…