VaultMorph Vault
VaultMorph Vault
A fully offline password manager for Android and Windows desktop. Every credential, note, and TOTP secret is encrypted at rest — no cloud, no sync, no way for your data to leave the device.
No shortcuts. No "good enough." Every feature is built around the assumption that your secrets are worth protecting.
Every field — username, URL, notes, TOTP secret — encrypted independently with a unique 96-bit random nonce on every write.
Memory-hard and GPU/ASIC resistant — 128 MB / 4 iterations on Android, 64 MB / 3 iterations on Windows. Your master password is never stored in plain text — anywhere.
Built-in RFC 6238 TOTP with QR scanning and manual entry. Compatible with Google Authenticator and Microsoft Authenticator. Replay-attack protected.
Fingerprint and face unlock via Android BiometricPrompt API. Quick access without ever typing your master password in public.
Live entropy meter on all password fields with weakness and reuse detection. 50-bit minimum entropy enforced on registration. Generator up to 40 chars.
Portable encrypted backup format with magic-header verification and KDF version tagging. Auto-backup on every add, edit, and delete.
On Android, network_security_config.xml blocks all outbound traffic at the OS level. On Windows, there is simply no network code — no sync, no update pings, nothing to phone home.
Android: 30-minute idle timeout, progressive lockout after 5/10/20 failures, 30-second clipboard auto-clear. Windows: instant lock when the window loses focus, master key wiped from memory.
Banking, Social, Work, Email, Gaming, Health, Travel and more. Colour-coded cards, instant search, and category filters.
Store recovery codes, licence keys, and sensitive text with the same per-field AES-256-GCM encryption as your passwords.
Vault was designed to pass a security audit from day one. Nothing here is marketing shorthand — this is the actual implementation.
| Layer | Technology |
|---|---|
| Vault encryption | AES-256-GCM, per-field, 96-bit nonce/write, 128-bit MAC |
| Key derivation | Argon2id — 128 MB / 4 iter (Android) · 64 MB / 3 iter (Windows) |
| Login hash | Argon2id (same params, GPU/ASIC resistant) |
| 2FA | TOTP RFC 6238 · replay attack protection (Android) |
| Biometric | BiometricPrompt API (Android) |
| Key storage | EncryptedSharedPreferences (Android) · Credential Manager (Windows) |
| Backup format | .vmb — AES-256-GCM + magic header + KDF version |
| Screenshot block | FLAG_SECURE on all screens (Android) |
| Session lock | 30-min idle + lockout (Android) · lock on focus loss + key wipe (Windows) |
| Database | SQLite, local only — all fields encrypted at rest |
| Network | Blocked via OS config (Android) · no network code paths (Windows) |
Universal CSV import with automatic column detection — no manual field mapping — on both Android and Windows. Windows also supports CSV export, so your data is never locked in.
Free community builds for both platforms — no account, no cloud, no internet required. Install and your vault stays yours.