Your secrets never leave your phone.
3.0.0 is a rewrite, and a different app. Versions 2.x were written in Flutter and installed as
com.passtech.pass_tech; this one is Kotlin and installs as com.filestech.pass_tech. They live
side by side. To move across, export a .ptbak backup from 2.x and import it here — then remove
the old one once you are satisfied.
Why Pass Tech
Most password managers sync through their own cloud, which means trusting the provider completely.
Pass Tech takes the opposite stance: no server, no account, no possible backend breach, because
there is no backend.
- Local — the vault is a file in the app's private directory and goes nowhere else
- Open source — Apache License 2.0, and every release publishes the SHA-256 of each file
- Bound to the phone — a key in the secure chip takes part in every unlock attempt
- No Google libraries — no Play Services, no ML Kit, no Firebase, no telemetry
- For when you are made to open it — decoy vault, panic mode, heir access
- Two network calls, both named — the GitHub update check, and the opt-in breach check
Features
- Passwords, bank cards and secure notes, with a generator: 8 to 64 characters, or a passphrase
drawn from a word list in the language the app is showing
- TOTP two-factor codes (RFC 6238) — paste the
otpauth:// URI a site shows under its QR code
- Search by title, username, address or content; sort four ways
- Security audit: weak, reused, no second factor; breach check against Have I Been Pwned
- Address check before a password is copied, across nine browsers, with several addresses per entry
- Encrypted
.ptbak backup, plain export, and import from Chrome, Edge, Bitwarden JSON or CSV
- The privacy policy and the terms are read inside the app, with no network
- Five languages — English, French, German, Italian, Spanish — picked in the app, whatever the phone
is set to
If someone makes you open it
- Decoy vault — a second master password opens a second vault with its own entries. Three slots
exist from the first launch, all kept the same size, so nothing in the files says how many you use.
- Panic mode — locks, clears the clipboard, disarms the fingerprint, withdraws the address check
and replaces the name and icon on the home screen with a calculator that really works. Nothing is
deleted.
- Heir access — someone you choose opens a read-only snapshot of the vault after a long enough
silence on your side. On the phone, with no cloud and no third party.
Security
| Component | Choice |
|---|
| Key derivation | Argon2id (RFC 9106) — m = 19 MiB, t = 2, p = 1, 32-byte output (OWASP 2024 mobile) |
| Hardware step | HMAC-SHA256 computed inside the Android Keystore, over domain || Argon2id output, with a key that never leaves it |
| Final key | HKDF-SHA256(salt, argon || hmac, info, 32) — domain and info separate a vault file from an heir snapshot |
| Encryption | AES-256-GCM (NIST SP 800-38D), 96-bit nonce, 128-bit tag |
| Plausible deniability | Three slots created at first launch, all the same size; unused ones hold random data under a key that exists nowhere |
| Biometrics | Android Keystore + BiometricPrompt CryptoObject, invalidated when the phone's fingerprints change |
| Anti-brute-force | Five free attempts, then 30 s → 30 min, counted in the encrypted state file and surviving a restart |
| Screenshots | FLAG_SECURE on every screen while the setting is on, including the recent-apps thumbnail |
| Clipboard | Cleared after a chosen delay, even in the background, and flagged sensitive on Android 13+ |
| Device checks | Root, emulator and debugger detection, shown on the unlock screen. It warns; it never blocks |
| Backup | Android cloud backup and phone-to-phone transfer both excluded, for every domain |
| APK signature | v2, v3 and v4; no v1, the scheme Janus (CVE-2017-13156) attacks |
| Updates | SHA-256 published for every file of every release |
The permission set is pinned in config/expected-permissions.txt
and checked on the built APK's merged manifest by the Promises workflow, both ways: a
permission that appears unlisted fails the build, and so does one listed that disappears.
See THREAT_MODEL.md for what is protected, against whom, and what is not. See
SECURITY.md to report a vulnerability.
Screenshots
fastlane/metadata/android/en-US/images/phoneScreenshots
Install
Option 1 — Obtainium (recommended, automatic updates)
- Install Obtainium
- Add this URL:
https://github.com/gitubpatrice/pass_tech
Option 2 — Direct APK
Download the APK from the latest release
(Android 8.0 and above).
Verify integrity:
sha256sum <the file you downloaded>
The hash must match the one published for that same file on the release page. If the two differ, do
not install it.
Samsung One UI 6.1+: if the install is blocked, temporarily disable
Settings → Security and privacy → Auto Blocker.
Permissions
Measured on the built APK, not read from the source manifest:
| Permission | Why |
|---|
INTERNET | The update check (GitHub Releases) and the opt-in breach check (HIBP, k-anonymity). No other request. |
USE_BIOMETRIC | Optional fingerprint unlock, through androidx.biometric. |
USE_FINGERPRINT | The same, on Android 8 (API < 28), where androidx.biometric still needs it. |
…DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION | Added by an AndroidX library; it lets the app send a broadcast to itself and nothing else. |
No camera, no contacts, no location, no storage: the app asks the system for a file when you export
or import one, and the system hands it that file.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
