Sachwert-Tresor

• Bitcoin, gold & silver — record buys, sells and withdrawals. Metals by count × denomination (coin/bar, fineness, dealer).
• Net holdings & value — what you actually hold, plus invested cost. You enter current prices yourself (deliberately no network lookup) or, since v3.9, paste the price line from Mission Control → value and profit/loss from that.
• EUR, USD or CHF — record each entry in its own currency (since v2.1). Totals stay separate per currency, nothing is converted — the app never fetches exchange rates. Optionally add the EUR equivalent from the transaction date so the tax-tool export stays complete.
• KYC separation — broker buys (KYC) and private/P2P (noKYC) stay cleanly separated.
• Tax-tool export — exports manual_buys.csv / manual_sales.csv straight into the format of the BTC tax tool.
• Wealth over time (since v2.12) — every price you enter in the overview is remembered with its date (one snapshot per day). The history tab draws the value of your holdings next to your dashed cost basis, with period switches (YTD/1Y/3Y/5Y/MAX) and a tooltip naming value, cost basis and difference for any day. Still no price lookups: only your own snapshots are used — and before the first one there is deliberately no value line rather than invented numbers.
• Estate appendix (since v2.6) — one sheet with your net holdings for the heir package, laid out like the Estate Planner: version, date, destruction note, notes in plain language for the heir. Quantities with denominations only, no prices, dealers or locations. The vault knows the amounts, the planner knows the places — the appendix brings both together without either tool reading the other's data.
• Encrypted backup & sync — the .vault file is fully encrypted and can be synced between devices via Syncthing, without any cloud. Since v3.11, restoring a backup also updates the prices in the overview if the backup has prices from a newer day than the device (filled-in ones only); an older backup never changes them.
• Bilingual — German and English, switchable in the app.

• Encryption with AES-256-GCM through the native WebCrypto of the browser engine (Android WebView or Electron). Since v3.0 the key is derived from your passphrase with Argon2id (64 MiB of memory, 3 passes): every guess costs memory, which makes brute-forcing on GPUs and specialised chips far more expensive than with the former PBKDF2. Argon2id comes from the open-source library hash-wasm (MIT), bundled and checked against a pinned SHA-256 at build time.
• Old vaults and backups keep opening. A vault from an older version is switched over automatically on the first unlock — it is only written after the new file has been test-decrypted.
• Optional 2FA second factor (Aegis / TOTP, RFC 6238) on unlock.
• Failed-attempt brake (since v3.0) — after 3 wrong attempts a growing wait of up to 30 seconds kicks in. A bolt against guessing on the device, not cryptographic protection.
• No reset, no backdoor. Forget the passphrase and the data is gone — but nobody else can get in either.
• Open source. The full client code is public — you don't have to trust, you can check that nothing phones home.

Why the Android app protects more than a website

The vault is deliberately not a website: the native app (since v2.0) is locked down at the operating-system level, which a page in the browser simply cannot do:

• No INTERNET permission. The app's network right is stripped from the Android manifest entirely — it cannot open a connection at all. "No telemetry" is verifiable, not just promised. Since v3.0 its only system permission is USE_BIOMETRIC for the optional fingerprint unlock, plus USE_FINGERPRINT, brought in by androidx.biometric and limited by the app to Android 8.1 and below. The also-listed …DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION is an app-internal AndroidX signature permission with no system access. The build aborts as soon as the finished APK requests any other permission.
• FLAG_SECURE. No screenshots, no screen recording, no holdings preview in the app switcher. Since v3.6.1 the app also keeps its fields out of the Android autofill framework: another password manager set up as the autofill service does not see the passphrase fields and cannot offer to save them.
• Keyboard request (since v3.11). Every input field asks the keyboard app not to learn from it (Gboard then shows its incognito icon). This is only a request: not every keyboard honours it, and the keyboard still sees what you type.
• Confirmations in an in-app dialog (since v3.5). Deleting, possible duplicates, disabling 2FA/fingerprint and "Delete local data" ask in a dialog inside the app, not through the Android system dialog — which does not inherit FLAG_SECURE, so a screenshot taken during an open confirmation would have shown the dialog text (found internally during the device test of the sister app Alien Notes).
• Import after unlocking (since v3.6). If auto-lock expires while the file picker is open, the app still locks – no key stays in memory. The chosen file (.vault or CSV) is not lost: the app keeps only a reference, reads nothing while it is locked, and after unlocking the import continues with exactly this file (found internally during the device test of the sister app Alien Pass).
• No cloud/ADB backup, no transfer when switching phones. Your vault data lands in no automatic backup and is not copied along to a new device (since v3.0) — you make backups yourself, via the encrypted .vault file.
• Fingerprint (optional, since v3.0). A random key held by the Android Keystore unlocks the data key, released only after strong biometrics. Honestly: convenient, but it can be forced, and it is no extra factor. The passphrase stays mandatory after every restart (optional since v3.2: "also after a restart" box when enabling, off by default — the choice lives in the fingerprint slot and is authenticated there), after a passphrase change (fingerprint unlock is then off and must be re-enabled), after "Lock now" and as soon as a new fingerprint is enrolled in Android — the app then switches fingerprint unlock off and warns you. The restart rule is program code, not a cryptographic guarantee.

So on the phone the APK — on the Linux desktop the Flatpak, whose hardening is described in the next section.

The desktop version, honestly assessed

• No network, enforced by the system. The Flatpak has no network permission and no access to your files. Backup, import, CSV export and the estate sheet go through the system file dialog, which only grants the chosen file. Verifiable with flatpak info --show-permissions org.alieninvestor.tresor.
• Estate sheet as PDF. There is no printer inside the sandbox — the desktop version saves the sheet as a PDF via the save dialog. Like CSV exports this is plain text: delete it after use. Since v3.11 the sheet, like CSV and .txt, only goes to the shell after your choice in the save dialog: if the app locks while the dialog is open, nothing is saved.
• Clipboard. What the app copies (2FA key, Ctrl+C and Ctrl+X) is marked as a password for KDE, so Klipper keeps it out of its history (tested under Plasma; other clipboard managers may ignore the mark). The app clears its own copy after 30 seconds, on lock and on quit. Since v3.7 the same applies to text you select in the app – under X11 it lands in the middle-click selection right away, even from a masked password field, for example after tabbing into the filled-in passphrase. Klipper can mirror every copy into this middle-click selection as well (setting “Keep the selection and clipboard the same”) – the app clears it there too. Only what still comes from the app is cleared. Selected text does not carry the KDE mark: if Klipper is set to keep the selection in its history, switch that off. Since v3.10 Ctrl+A only selects the content of a filled-in text or number field instead of the whole page, and the app also clears selections spanning buttons, fields and the chart as well as selected amounts and quantities. Exceptions: a selection that reaches across the date field in the entry form stays until the next selection, and so does the text of a number field if you click its arrows while it holds something other than the plain number. Since v3.11 the app also clears text that Ctrl+Z or Ctrl+Y bring back only after the 30 seconds have passed, and the 2FA key when you drag it with the mouse during setup.
• Its own browser engine. The desktop app ships Electron itself. Security updates for it only arrive with a new app version, not through the system.
• Limits: no protection against screenshots (Linux has no counterpart to FLAG_SECURE). Under X11 every running program can read keyboard and clipboard; Wayland separates programs better. On screen lock and suspend the app does not lock by itself: use the system lock (especially for suspend) plus a short inactivity lock; Ctrl+L locks immediately. On the desktop "background" means minimised or hidden — switching windows does not lock, but it clears typed passphrases. No fingerprint.
• Origin: shell and hardening are the port from Alien Pass (three internal audits there); the vault's shell is checked with tests in the real shell, v3.7 added an internal security audit of the changes, v3.10 was preceded by a targeted internal audit in four rounds, and v3.11 by an internal release audit of the changes in two rounds with a follow-up check; v3.11 also adopts findings from the internal audits of the sister apps Alien Pass and Alien Notes.

Open source on GitHub

The client code is open source (MIT license) and free. Build, signing and server internals stay private; the verifiable part — the app itself — is open. No accounts, no server dependency.

🔗 github.com/Alien-Investor/sachwert-tresor