Alien Pass

• Four entry types — logins (title, username, since v1.4 an optional second e-mail address, password, URL, notes, optional TOTP), encrypted notes, cards (holder, number, expiry, CVV, PIN — masked, copyable) and, since v1.3, accounts (holder, IBAN, BIC, bank, PIN — the list shows the IBAN masked, the PIN only on request). Favourites, search across everything.
• Categories — like folders: type one freely, filter chips above the list. On Proton import the vaults become categories.
• Extra fields, always secret (since v1.4) — up to eight freely named fields per entry, for every type: app PIN, phone password, security question, withdrawal PIN. The value shows only on request and has its own copy button; the label is searchable, the value never. Nothing has to sit in the notes in plain text. Hidden fields from Proton Pass land right here on import.
• Password generator — character passwords (8–64) or dice words from the EFF list (six words ≈ 77 bits). Entropy is shown, honestly corrected in character mode for the rule “every chosen set appears”. Since v1.4 also right inside the entry form: “Generate” opens a panel with mode, length and character sets, every change generates anew.
• TOTP per entry — 2FA codes right at the login entry (RFC 6238, SHA-1/256/512). For critical accounts the app still recommends Aegis.
• Password health — flags reused, short and, since v1.6, predictable passwords: repetitions, character and keyboard sequences, years, common words also in leetspeak (P4ssw0rd), digits only. The strength meter names the reason while you type and honestly calls itself an “estimate” — it cannot tell whether a password relates to you (name, birthday); a truly strong one comes from the generator. For a predictable vault passphrase the app asks first, because it also protects every backup. Deliberately not age: a strong random password does not weaken with time, forced rotation is an anti-pattern (NIST SP 800-63B) — change it when it may have leaked. Purely local, no breach lookup.
• Clipboard auto-clear — 15, 30 or 60 seconds, also in the background as long as Android has not frozen the app; copied content is flagged sensitive so the system preview hides it (Android 13+). With “lock in background: immediately” the copied item stays until the time runs out, so it can still be pasted into another app (since v1.11). Since v1.22 both also apply to text you copy or cut via Android's selection bar; entries such as “Share”, “Web search” or “Translate” in that bar hand it straight to another app, without the clipboard.
• Auto-lock — after inactivity and in the background (immediately up to 5 minutes).
• Encrypted backup & sync — the .vault file is fully encrypted. Two devices are synced via export and import, e.g. through Syncthing: per entry the newer change wins, deletions are carried over.
• Trash (since v1.5) — deleted entries stay restorable for 30 days, up to 200 at a time — once it is full, the next deletion destroys the oldest one straight away. The trash shows only title, type and date of deletion — no reveal, no copy. “Delete permanently” destroys an entry right away. It is device-local: when merging, the deletion travels to your other devices, the content does not — you can only restore on the device where you deleted. Honestly: as long as an entry sits in the trash, it is also in every backup made on that device.
• Multi-select and “Undo” (since v1.9) — the ☑ icon next to the + turns on checkboxes on every row; the bar at the bottom moves the selected entries to the trash (with one shared “Undo”), gives them a category or marks them as favourites. “All” only takes what is currently visible. After deleting a single entry, “Undo” stays in the notice for six seconds.
• Migration from Proton Pass — straight from the export, preferably the PGP-encrypted one: the file travels to the phone encrypted and is only decrypted inside the app. Logins with TOTP, notes, credit cards, aliases, Wi-Fi and identities come along. Plus CSV import from Google Password Manager / Chrome, Apple Passwords, Firefox, KeePassXC, Bitwarden, LastPass, 1Password and NordPass (since v1.10) — the format is detected by the header, folders and tags become categories, favourites and TOTP come along; any other CSV with title and password works as well. With “lock in background: immediately” the chosen file is imported right after unlocking. Delete the plaintext export afterwards, the manual says so for every manager.
• Aegis hurdle — an optional TOTP code on unlock. Honestly named a hurdle against someone who peeked at your passphrase, not a second factor: the key lives inside the vault itself.
• Fingerprint unlock (since v1.2, optional) — the data key is additionally wrapped under a random key that the Android keystore releases only after a strong biometric; none of it enters backups. The passphrase stays the real protection: it is required after every restart (optional since v1.8: a box when enabling keeps the fingerprint working across a restart — off by default, the choice is authenticated inside the slot and can only be changed by disabling and re-enabling), after a passphrase change and when a new fingerprint is enrolled — and "Lock now" is the deliberate bolt for a border or handing the phone over: afterwards only the passphrase opens the vault. Since v1.6.1 the app notices a newly enrolled fingerprint even across a restart: it does not set access up again by itself and shows a warning until you have read it. Honestly: Android binds the key to every strong biometric of the device; where a strong face unlock is enrolled, it counts too (with a confirmation tap).
• Bilingual — German and English, manual inside the app.

• Argon2id derives the key from your passphrase (default 64 MiB, selectable 32/64/128) — memory-hard, so expensive for GPU attacks on a stolen file.
• AES-256-GCM via native WebCrypto. A random data key encrypts the vault; the passphrase only wraps that key. The file header is authenticated too — tampering is detected.
• Import limits. A foreign backup file cannot force arbitrary Argon2 parameters; all content passes a field whitelist — including your own vault on unlock.
• No reset, no backdoor. Forget the passphrase and the data is gone — but nobody else can get in either.
• Open source. The full client code is public; the bundled third-party code (Argon2 library, EFF word list) is hash-checked in the build. The OpenPGP reader for Proton exports is our own, deliberately small code, including its own AES block cipher, which the test suite checks against FIPS-197 vectors and WebCrypto. The native Android code (FLAG_SECURE, backup rules, clipboard and fingerprint plugin, since v1.22 the keyboard request) is in the repo in plaintext as well.
• Internal security audits (no independent audit) before v1.0, v1.1, v1.2 and v1.5 plus a targeted review of the changes before v1.4; v1.6.1 adopts two findings from the internal audit of the sister app Sachwert-Tresor, whose fingerprint code comes from Alien Pass. Before v1.7, two internal audits of the new desktop shell; before v1.8 a third one covering PIN unlock, the interplay of the three gates (passphrase, fingerprint, PIN) and the restart switch — no medium or severe findings. Before v1.15 a targeted internal audit of the deferred import and an internal diff review, before v1.18 and v1.19 internal release audits of the changes, before v1.19 in two rounds plus a re-check on the desktop clipboard, before v1.20 an internal diff review; v1.20 also adopts the desktop-clipboard findings from the internal release audit of the sister app Alien Notes — low findings only. Before v1.21 a targeted internal audit in three rounds on the middle-click selection on the desktop, prompted by a finding from the internal release audit of the sister app Alien Notes that also affected Alien Pass. Before v1.22 an internal release audit of the changes in two rounds; v1.22 also takes over findings from the internal audits of the sister apps Alien Notes and Sachwert-Tresor. Before v1.23 an internal release audit of the changes in two rounds plus a re-check; v1.23 also takes over findings from the internal audits of the sister apps Sachwert-Tresor, Alien Notes and BTC Steuertool. Before v1.24 two internal diff reviews of the changes, one of them focused on the modified share plugin and checked against the Android source; v1.24 also takes over a finding from the internal audit of the sister app Alien Fitness. The audit findings are fixed and covered by tests; a few were deliberately kept after review, most recently: while a copy's timer runs, it also covers a selection made afterwards. The fixed items are documented in the repo's changelog.

Hardened at the operating-system level

• No internet permission. The network right is stripped from the Android manifest entirely; "no telemetry" is verifiable, not just promised. The only permissions are the two normal ones for the fingerprint sensor (USE_BIOMETRIC, USE_FINGERPRINT up to Android 8.1) — plus an AndroidX-generated signature permission that grants nothing. The build aborts as soon as any other one appears.
• FLAG_SECURE. No screenshots, no screen recording, no password preview in the app switcher. Since v1.9 every confirmation is an in-app dialog as well: the Android system dialog did not inherit this protection, a screenshot with an open delete prompt showed the entry title (found internally during the Alien Notes device test). Since v1.13 the app also keeps its fields out of the Android autofill framework: another password manager set up as the autofill service does not see the passphrase fields and cannot offer to save them.
• No cloud, ADB or device-to-device backup. The vault lands in no automatic backup (backup rules exclude D2D transfer too) — you make backups yourself via the encrypted .vault file.
• Limits, stated honestly: no autofill — deliberately, because an autofill service would have to read the vault outside the app and keep the key in the background. Our own native code is limited to five small pieces, readable in the repo: FLAG_SECURE, backup exclusion, the clipboard and the fingerprint plugin, and since v1.22 a WebView subclass that asks the keyboard app not to learn from the fields (Gboard then shows its incognito icon; only a request, not every keyboard honours it). In addition, since v1.24 the build modifies Capacitor's share plugin, also readable in the repo: it no longer registers a receiver that other apps can reach and no longer passes a callback to the share sheet.

The desktop version, honestly assessed

• No network, enforced by the system. The Flatpak has no network permission and no access to your files. Backup and import go through the system file dialog, which only grants the chosen file. Verifiable with flatpak info --show-permissions org.alieninvestor.pass.
• Clipboard. Copied items are marked as a password for KDE, so Klipper keeps them out of its history (tested under Plasma). The app clears its copy after the set time, on lock and on quit — also after Ctrl+C, Ctrl+X and for text you select in the app with mouse or keyboard (on Linux instantly pasteable with a middle click). Klipper can mirror every copy into this middle-click selection as well (setting “Keep the selection and clipboard the same”); since v1.19 the app clears it there too, as long as it still comes from the app. If the clear on quit fails once, the app retries right away (since v1.20). Exception: if the app locks immediately when minimised (“lock in background: immediately”), a copy stays until the time runs out, so it can still be pasted, and so does a selection made during that time (since v1.11 and v1.19 respectively). Since v1.21 Ctrl+A only selects the content of a filled-in field, never the whole page.
• Its own browser engine. The desktop app ships Electron itself. Security updates for it only arrive with a new app version, not through the system.
• Limits: no protection against screenshots (Linux has no counterpart to FLAG_SECURE). Under X11 every running program can read keyboard and clipboard — this applies to every password manager; Wayland separates programs better. On screen lock and suspend the app does not lock by itself: use the system lock (especially for suspend) plus a short inactivity lock; Ctrl+L locks immediately. On the desktop "background" means minimised or hidden — switching windows does not lock, but it clears typed passphrases and PINs. No fingerprint.
• Quick unlock with a PIN (since v1.8, optional) — after a lock through inactivity or the background a PIN of 6 to 12 digits is enough instead of the passphrase, until the app is quit, at most 24 hours. Honestly: the PIN never protects the vault file (six digits are a tiny search space, roughly ten minutes on a graphics card); it only protects a copy of the data key that stays in memory when locking, and none of it is stored. Three wrong attempts, a passphrase change, a swapped vault file, altered header data or an altered passphrase slot, and quitting discard it (if only the file’s content is damaged, it stays, since v1.23); Ctrl+L is the bolt, afterwards the passphrase once. If you share the computer or have unencrypted swap, leave it off.

Open source on GitHub

The client code is open source (MIT license) and free. Build and signing internals stay private; the verifiable part — the app itself — is open. No accounts, no server dependency.

🔗 github.com/Alien-Investor/alien-pass