TBD Vault + TBD Codes

Two private Flutter apps for a single phone at a time. TBD Vault stores encrypted account details. TBD Codes supplies an eight-digit code that changes every 5–10 seconds. Both apps are designed to work without an internet connection.

This is custom password-manager software. Do not put irreplaceable passwords in it until the iPhone pairing, backup recovery, and security review have been completed on a real device. A code generated by another app on the same phone is an extra check, not a truly separate second factor.

Web version (current direction)

web/ holds TBD Vault and TBD Codes as two installable offline websites (PWAs). No App Store, APK or Mac needed. See web/README.md for building, deploying and installing. The Flutter apps in apps/ are kept but no longer the main path.

Current status of the Flutter apps (2026-10-09)

Automated tests pass (core, backup, vault lockout and replay). Android end-to-end testing, signed release APKs and all iPhone testing are not finished. See SECURITY-REVIEW.md and MAC-IPHONE-CHECKLIST.md. Do not store real passwords yet.

What is here

Folder	Purpose
apps/vault	iPhone and Android vault app
apps/codes	iPhone and Android code app
packages/tbd_core	Shared vault format, AES-256-GCM encryption, Argon2id backup, and code generation
packages/tbd_platform	Device-protected key access and app pairing
design	SVG icons, rendered previews, and bundled-font licenses

The fonts and icon assets are bundled in the apps. There are no accounts, analytics, remote APIs, or app-managed network calls. Android release manifests contain no INTERNET permission. The operating system's file picker may still offer cloud locations; select local storage for strictly offline backups.

Friend's setup

1. Install both apps on the same iPhone. Set a phone passcode and Face ID or Touch ID first.
2. Open TBD Vault and tap Create Vault.
3. Open TBD Codes and tap Pair with Vault within five minutes.
4. Copy the current code. Return to TBD Vault and enter it. The default code interval is 10 seconds; shorter intervals are harder to use.
5. Export the first encrypted backup and set a separate backup password of at least 12 characters. Save the file and password in different safe places. In the vault menu, choose Test encrypted backup, select that saved file, and enter its password to check that it opens without replacing the vault. The vault asks for the first backup before adding an account.
6. Add account name, website or platform, username, and password. Export a fresh backup after later changes; the app shows when one is needed.

To move to a new phone, install both apps, choose Restore Encrypted Backup in TBD Vault, select the .tbdbackup file, enter its backup password, pair TBD Codes, and enter the new code. iPhone and Android use the same backup format. There is no server or forgotten-password recovery.

Build and verify

Flutter 3.47.7 / Dart 3.13.5 was used for this source. From each app folder run flutter pub get, then flutter analyze. From packages/tbd_core, run dart test. The shared tests cover the RFC 6238 SHA-256 code vector, vault encryption, altered backup rejection, and repeat file saves.

iPhone first

Building and installing the iPhone apps requires a Mac with Xcode, an Apple Developer membership, and the friend's iPhone registered for private distribution. Both app IDs must belong to the same Apple team and have the shared Keychain group com.techboydeepak.tbd.shared. In Xcode, set the same Team for both Runner targets and confirm Runner.entitlements is included in each signing profile. Build both apps with --dart-define=TBD_TEAM_ID=YOUR_10_CHARACTER_TEAM_ID so the runtime uses the matching Keychain access group. Archive and distribute to the registered device as Ad Hoc apps. Do not change either bundle ID after storing real passwords without a tested migration.

iPhone builds, signing, installation, biometric prompts, and app-to-app pairing have not been verified on this Windows machine. They must be tested on the actual iPhone before daily use. Free Apple personal signing can expire after seven days; TestFlight builds expire after 90 days, which is why private registered-device distribution is planned.

Android after iPhone verification

The Android apps require Android 11 or newer. Debug builds of both apps from the same machine use the same debug signing certificate and can pair. Private release builds must be signed with the same release keystore. Set TBD_ANDROID_KEYSTORE, TBD_ANDROID_STORE_PASSWORD, TBD_ANDROID_KEY_ALIAS, and TBD_ANDROID_KEY_PASSWORD as environment variables before building each release APK. Never put the keystore or passwords in this repository. Do not distribute a debug-signed APK for password storage.

Android and iPhone data do not synchronize automatically. Move only the encrypted .tbdbackup file by a method you choose, such as a local file transfer, and restore it on the destination phone.

Security boundaries

• Vault data is AES-256-GCM encrypted in app-private storage. Its random key is held in iOS Keychain or Android Keystore-backed storage that requires device authentication to read.
• The code seed is copied to TBD Codes only through a short-lived, OS-restricted pairing channel. Android limits the channel to apps signed with the same key; iPhone limits it to the same Apple team Keychain group.
• Backups use Argon2id to derive a key from the user-chosen password and AES-256-GCM to encrypt and authenticate the contents. The backup contains the code seed so a replacement phone can pair its new Codes app.
• Both apps hide their screens when backgrounded. The vault locks after leaving an open vault. While waiting for a code, the vault preserves only the code-entry step for up to one minute so switching apps is practical.
• Copying a password or code: on iPhone the item is local-only and expires on its own; on Android it is marked sensitive and cleared by the apps when they are in the foreground (Android has no clipboard expiry, so a copied password can remain if you do not return to the app). Not yet tested on a real device.
• No independent professional security audit or real-device penetration test has been completed. Keep a separate verified copy of important passwords during evaluation.

Sources and design

Visual colors and fonts follow techboydeepak.com: #080808, #f4f1ec, #f22d1c, Manrope, Bebas Neue, and IBM Plex Mono. Font licenses are in design/licenses. The two SVG icon sources are in design; rerender platform assets with python tools/render_icons.py after installing resvg-py.

The code interval is deliberately shorter than the RFC 6238 recommendation of 30 seconds, following the requested 5–10 second setting. Ten seconds is the default.