A password manager for iOS and Android

The password manager that asks for nothing.

No account. No email. No sync. Stonevault ships without network permission, so your vault stays on your phone, and part of its key never leaves the phone's secure hardware.

Free. Open source. Nothing to sign up for.
What makes it different
01 · NETWORK

It never touches the network.

There is no server to breach and no telemetry to opt out of. The app is built without network permission at all. You do not have to take that on trust: it is a property of the binary, and anyone can check it.

$ aapt dump permissions stonevault.apk uses-permission: android.permission.USE_BIOMETRIC uses-permission: android.permission.VIBRATE # no INTERNET permission. nothing phones home.
02 · HARDWARE

The vault is bound to your phone.

Unlocking takes two things: your master password, and a key sealed in the phone's secure hardware. A stolen vault file is not enough. Without this exact phone, it cannot be brute-forced offline, however fast the attacker's machines are.

vault key = argon2id(master password) ⊕ key sealed in Secure Enclave / StrongBox # the second half never leaves the chip
How it holds
01

Create quietly

The first screen asks for a master password. That is the entire onboarding: no email, no account, no verification code.

02

Seal to the phone

Keys derive on the device and bind to its secure element. Nothing is escrowed anywhere, and nothing about you is recoverable by anyone else.

03

Keep it recoverable

A recovery kit you actually complete, encrypted backups you export yourself, and a verifier that reads a backup end to end before you ever need it.

Built in the open, by one person.

The entire app is public: the crypto, the storage format, the autofill service. Releases are reproducible, so you can build the source yourself and compare binaries. If a claim on this page is wrong, the code is where you prove it.

$ git clone github.com/rafi-ramdhani/stonevault
Source on GitHub
Questions with honest answers
I forgot my master password.

Then the data is gone, unless you saved your recovery kit. Nobody can unlock the vault for you: not the developer, not Apple or Google, not a support request. That is the cost of a vault nobody else can open, and the app says so plainly before you create one.

What happens when I get a new phone?

Restore from your backup file with your recovery code. A system transfer alone is not enough, because the hardware half of the key stays in the old phone's secure element by design.

How do I sync between devices?

You don't. Sync means a server, and a server means trusting someone with your account list. Stonevault has neither. Export an encrypted backup and carry it yourself.

Why should I believe any of this?

You shouldn't have to. Check the manifest for network permission, read the source, build it yourself and compare the binaries. Every claim here is verifiable without asking us.