Alien Pass

about

description

Alien Pass is a local, encrypted password manager. It runs fully offline — no cloud, no server, no account, no telemetry. The app requests no INTERNET permission — only the two normal permissions for the fingerprint sensor (USE_BIOMETRIC, USE_FINGERPRINT up to Android 8.1). Your passwords never leave the device in plaintext. Features: - Four entry types: logins (title, username, optional e-mail, password, URL, notes, TOTP), encrypted notes, cards (holder, number, expiry, CVV, PIN — masked, copyable) and bank accounts (holder, IBAN, BIC, bank, PIN); favourites; instant search - Extra fields, always secret (v1.4): up to eight freely named fields per entry (app PIN, phone password, security question …), revealed only on request, each with its own copy button — nothing has to sit in the notes in plain text - Categories like folders: filter chips above the list, suggestions from existing ones - Argon2id key derivation (32/64/128 MiB, self-benchmarked at setup) + AES-256-GCM via WebCrypto; a random data key is wrapped by your passphrase, file header authenticated (AAD) - Auto-lock after inactivity and in the background (immediately up to 5 min) - Clipboard auto-clear (15/30/60 s) — on timeout, on return to the app and on lock (with "lock in background: immediately" the copied item stays until the timeout, so it can still be pasted elsewhere); copied content is flagged sensitive so the Android 13+ system preview hides it. Since v1.22 both also apply to copy and cut via Android's selection bar (entries such as "Share" hand the text straight to another app, without the clipboard) - Asks the keyboard app not to learn from the app's fields (v1.22; Gboard then shows its incognito icon) — only a request, not every keyboard honours it - Password generator: characters (8–64) and Diceware (EFF Large Wordlist), entropy shown — also right inside the entry form (panel under the password field, same settings as the generator tab) - TOTP per entry (RFC 6238, SHA-1/256/512, 6–8 digits) with remaining time - Password health: reused, short and predictable passwords flagged (repeats, sequences, keyboard runs, years, common words also in leetspeak) — computed locally, an honest estimate; asks before accepting a predictable vault passphrase; no forced rotation by age (NIST SP 800-63B) - Multi-select (v1.9): checkboxes on every row, move several entries to the trash with one shared "Undo", set a category or mark favourites; "Undo" right after deleting a single entry (six seconds). All confirmations are in-app dialogs since v1.9 — the Android system dialog does not inherit FLAG_SECURE, a screenshot with an open delete prompt showed the entry title - Trash (v1.5): deleted entries stay restorable for 30 days, up to 200 at a time; the trash shows only title, type and date of deletion, never the content. "Delete permanently" destroys an entry right away. The trash is device-local: a deletion travels to your other devices when merging, the content does not. - Encrypted .vault backup and merge between devices (newer change wins, deletions carried for a year) — you move the file yourself, we recommend Syncthing (no account, no cloud storage); a USB cable or stick works just as well. The app never reads a sync folder on its own. - Import Proton Pass exports directly — PGP-encrypted (recommended), ZIP or JSON — with a small built-in OpenPGP reader (own AES block cipher, checked against FIPS-197 and WebCrypto in the test suite); vaults become categories, cards and notes come along, hidden custom fields become secret extra fields, a second e-mail address goes into the e-mail field - CSV import from Google Password Manager/Chrome, Apple Passwords, Firefox, KeePassXC, Bitwarden, LastPass, 1Password, NordPass and Proton Pass (v1.10; detected by header, folders/groups/tags become categories, favourites and TOTP come along; with "lock in background: immediately" the chosen file is imported right after unlocking) - Optional Aegis hurdle: an extra TOTP code on unlock (honestly documented as a hurdle, not a second factor) - Optional fingerprint unlock (Android keystore; passphrase required after a passphrase change or a new fingerprint, and after every restart unless you tick "also after a restart" when enabling (v1.8, off by default, the choice is authenticated inside the slot); honestly documented: any strong biometric of the device counts, with a confirmation tap) - Linux desktop edition (Flatpak without network permission, since v1.7) with optional quick unlock by PIN after a lock (v1.8, in memory only, at most 24 hours, honestly documented) — see the GitHub release - No INTERNET permission; only USE_BIOMETRIC and USE_FINGERPRINT (up to Android 8.1) for the fingerprint sensor (plus the AndroidX-generated signature permission that grants nothing), FLAG_SECURE (no screenshots / recents preview), allowBackup=false + data extraction rules (no cloud, adb or D2D backup), WebView excluded from the Android autofill framework (a third-party autofill service never sees the passphrase fields) - Strict CSP: connect-src 'none', no inline script; bundled Argon2 (hash-wasm) hash-checked in the build - German / English, offline in-app manual, open source (MIT) Signing certificate SHA-256 (verify with AppVerifier), identical for every version: 73:C7:17:D8:05:6C:6A:02:B0:8B:AB:BA:24:18:17:F3:93:E4:6D:EA:03:19:D4:FA:26:B8:C3:D8:E1:F9:3C:95 apksigner (no separators): 73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

publisher

c4fe4db774908f9e909871277166b050ae59bc8faf578c9fb737e804d82b0fff

first seen

2026-09-17T22:32:58.779877+00:00

last event

2026-10-18 09:37 UTC

website

https://alien-investor.org/alien-pass.html

install

zapstore.dev or any Zapstore-compatible client

topics

#password #privacy #security #tools

source & build

repository

https://github.com/Alien-Investor/alien-pass

arch flags

android-arm64-v8a android-armeabi-v7a android-x86 android-x86_64

manifest

zapstore.yaml ok checked 2026-10-07T09:11:20.234091+00:00

{
  "icon": "./assets/icon-only.png",
  "images": [
    "./screenshots/1-list.png",
    "./screenshots/2-detail.png",
    "./screenshots/3-generator.png"
  ],
  "license": "MIT",
  "match": ".*\\.apk$",
  "name": "Alien Pass",
  "release_notes": "./CHANGELOG.md",
  "repository": "https://github.com/Alien-Investor/alien-pass",
  "summary": "Offline password manager \u2014 Argon2id + AES-256-GCM, no internet permission, no cloud, optional fingerprint unlock.",
  "tags": [
    "password",
    "security",
    "privacy",
    "tools"
  ],
  "website": "https://alien-investor.org/alien-pass.html"
}

releases (kind 30063)

19 releases indexed; latest 1.23.

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

1.23 — alien-pass-1.23.apk

sha256

a2f14f7b736e2bdf22642cac522fc20adbb012137a87e19ebc690289fcd29a05

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

38

apk cert sha256

73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

download

alien-pass-1.23.apk

1.22 — alien-pass-1.22.apk

sha256

487b6ae3045a910f89532164ec5251588da6e4e2d22f9e80691abc62b6c8e16c

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

36

apk cert sha256

73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

download

alien-pass-1.22.apk

1.21 — alien-pass-1.21.apk

sha256

77836b40c7e74696bfbf0edfa74fe02fb3c7ab99a99f49af94a681ad5200214a

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

35

apk cert sha256

73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

download

alien-pass-1.21.apk

1.20 — alien-pass-1.20.apk

sha256

57564bf783982261270386bf7658e60f3133f46329b11558fbc275a5f75d8c6c

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

34

apk cert sha256

73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

download

alien-pass-1.20.apk

1.19 — alien-pass-1.19.apk

sha256

586f8528f335847a45cc062602680f4ac04e07a32da3e9a9818fe860f32946a4

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

33

apk cert sha256

73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

download

alien-pass-1.19.apk

1.18 — alien-pass-1.18.apk

sha256

57f961ba675bcec1d1a15bd3ccf336a9fb5c3fe07dc37da19ed1facb64bc8a5c

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

32

apk cert sha256

73c717d8056c6a02b08babba241817f393e46dea0319d4fa26b8c3d8e1f93c95

download

alien-pass-1.18.apk

Showing the newest 6 asset descriptors; the full set is in /api/apps/c4fe4db7…