Get started with the Android app

VaultKeepR for Android is a zero-knowledge password vault. Your vault is encrypted on your device with XChaCha20-Poly1305, and the encryption key is derived from your master password with Argon2id (t=3, m=64 MiB, p=4). Nothing readable ever leaves the device: no account, no cloud, no server that can read your secrets. The app is free; optional Premium features are available with a subscription.

This guide walks you through installing, creating your vault, and setting up the features you will use every day: biometric unlock, AutoFill, 2FA codes, sync, and the security toolkit.

Install

From Google Play

Install VaultKeepR from Google Play. Updates are delivered through the store automatically.

From a signed APK

If you install outside the Play Store, choose a release that includes an APK and its signatures, and verify it before installing. The example below uses minisign (Ed25519) and a signed checksum manifest.

Historical example: v1.8.5 includes this APK, its signature, checksums and their signature. This is not a recommendation to install an old version or a statement of the current store version. The v1.8.10 tag has no client assets in the inventory used for this example. For another version, first check the assets on its release page and use their exact filenames.

Prerequisites: GitHub CLI (gh), curl, minisign and shasum. Use an empty directory. The command downloads all release assets because checksums.txt also references the iOS and browser archives. Check that the public key matches the signing key published by the project before trusting it. Authenticate checksums.txt before using its checksums:

set -euo pipefail
gh release download v1.8.5 -R VaultKeepR/vaultkeepr-public
curl --fail --location --output minisign.pub https://raw.githubusercontent.com/VaultKeepR/vaultkeepr-public/main/minisign.pub
minisign -Vm checksums.txt -x checksums.txt.minisig -p minisign.pub
minisign -Vm VaultKeepR-v1.8.5-android.apk -x VaultKeepR-v1.8.5-android.apk.minisig -p minisign.pub
shasum -a 256 -c checksums.txt

If the signature or checksum does not match, do not install the file and open a security advisory. The full procedure is on the security policy page.

Create your vault

1. Open the app and choose to create a new vault.
2. Set a master password. This password derives your encryption key; it never leaves the device and cannot be reset by anyone, including us. Write it down and keep it safe.
3. Create a recovery kit. Your vault key is split with Shamir secret sharing into encrypted fragments you can store in separate places (cloud storage, another device, printed paper). Without the master password or a recovery kit, the vault cannot be recovered — this is by design. See recovery for how the fragments and digital legacy work.
4. Complete the unlock screen and your vault opens.

On Android, the biometric key and short-lived delegation tokens are stored in hardware-backed Android Keystore with WHEN_UNLOCKED_THIS_DEVICE_ONLY access, so they cannot be read by other apps or backed up off the device.

Add entries

Store passwords, usernames, TOTP codes, secure notes, and payment cards in your vault. Organize entries with tags and favorites, and find anything with instant search. The vault also works fully offline — sync is optional.

Biometric unlock

Instead of typing your master password every time, you can unlock with your fingerprint or face. On Android this uses BiometricPrompt with keys held in Android Keystore; the key material is protected by hardware and never leaves the device.

To enable it, open Settings and turn on biometric unlock while your vault is unlocked. If your device has no biometric hardware, the app falls back to your device credential (PIN, pattern, or password). If you change your device credential, you may be asked to re-enroll biometrics.

The vault still auto-locks after 15 minutes of inactivity (cached keys are purged), and you can lock it manually at any time.

AutoFill

VaultKeepR provides an Android autofill service, so you can fill credentials into any app and any browser without switching apps.

1. Open Android Settings, then search for “autofill” (the exact path varies by manufacturer).
2. Select VaultKeepR as the autofill service.
3. When a login field is focused, tap the autofill suggestion and unlock the vault with biometrics if enabled.

2FA and TOTP codes

VaultKeepR has a built-in authenticator, so you do not need a separate app. When editing an entry, add its TOTP secret; the app generates rotating 6-digit codes right next to the entry. Tap a code to copy it.

Store the TOTP secret in the same entry as the password, or in a separate entry if you prefer. Because TOTP secrets are vault data, they are encrypted with the same XChaCha20-Poly1305 scheme as everything else.

Encrypted IPFS sync

Sync replicates your encrypted vault between devices through decentralized IPFS storage. No cloud account is required: the payload that travels is ciphertext, addressed by a content identifier (CID), and the latest CID is anchored in the VaultKeeperCidRegistry contract on Base L2. Even if an observer grabs the payload from IPFS, it is unreadable without your key.

1. Open Settings and enable sync.
2. Repeat on your other devices with the same vault.
3. The app polls for new CIDs in the background on a configurable schedule (5 minutes by default; you can set it to manual or off). Changes are merged automatically.

On Android, sync runs through a JSON vault format on the Hermes JavaScript engine, with background CID polling and background autosave. Autosave uses short-lived delegation signatures stored in Android Keystore so the app can save your vault without prompting for a wallet signature on every change.

See sync for the full architecture.

Tools

The security toolkit in the app includes:

• Password generator with a strength meter — create random passwords or passphrases for new accounts.
• Breach scanner via Have I Been Pwned — checks whether a password appears in known data leaks using k-anonymity: only the first five characters of a local SHA-1 hash are sent over TLS, and the full hash is matched on-device, so the server never learns your password. Email breach monitoring can also alert you when your addresses appear in leaks.
• Health score — an overview of your vault: weak, reused, or breached passwords, missing 2FA, and aging entries.

If you lose your phone

Your master password alone cannot restore your vault to a new device without the encrypted data — and your key cannot be rebuilt from the password alone in every flow, which is why the recovery kit matters. When you created your vault you produced Shamir fragments; with any quorum of them plus your master password, you can restore the vault key on a new device. You can also designate a legacy contact who can recover the vault after you.

If you did not save a recovery kit and you lose both the device and the master password, the vault is unrecoverable. See recovery for the details, and the security policy page for how releases are signed and how to report a vulnerability.