Your keys stay yours.
Keythentic keeps your 2FA codes, passwords and passkeys in one encrypted vault on your phone. It’s locked with a master password only you know — we couldn’t open your vault even if we wanted to.
- Free on Android, no account, no ads
- AES-256 on your phone
- Works offline
- Android 8.0+
Every app says “secure”. Here’s exactly what leaves your phone.
Your vault is encrypted on your phone before it’s written to disk or uploaded anywhere. A few things do leave, and we’d rather list them than bury them.
Stays on your phone
Never sent anywhere, by design.
- Your master passwordNever sentIt unlocks the vault on your phone and nowhere else.
- Your passwords, codes and passkeysNever sentEncrypted with AES-256-GCM, with the key derived by Argon2id.
- Your fingerprint or faceNever sentHandled by your phone’s secure hardware. Keythentic never sees it.
- Where you fill your loginsNever sentAutofill matching happens on the phone. There’s no analytics SDK and no ad network in the app.
What leaves, and why
Only when you turn it on or tap it.
- 5 characters of a hashWhen you tapThe breach check sends the first five characters of a password’s SHA-1 hash. The match is worked out on your phone.
- Your encrypted vault fileIf you turn it onBackups go to a private folder in your own Google Drive, still encrypted. We never see the file.
- A brand name, for its logoIf you turn it onOur server sees which brand’s logo you asked for, never your usernames or passwords. Each logo is kept once downloaded.
- Public files and the sign-in relayAs neededThe logo list and in-app notices are the same for everyone. Desktop sign-in passes end-to-end encrypted messages through the standard FIDO relay.
The full design, in plain language: Security architecture →
One app instead of three
Keythentic replaces your authenticator, your password manager and your passkey provider. Each login keeps its 2FA code right next to its password.
2FA codes (TOTP & HOTP)
Scan a QR code or type in the secret. Codes refresh on their own, using the same standard as Google Authenticator and Authy.
Encrypted password vault
Logins, cards and secure notes, with a generator, a strength meter and folders.
Passkeys
Create and store passkeys and use them anywhere on your phone through Android’s Credential Manager.
Sign in on your computer
With the Keythentic extension for Chrome, scan a code and approve on your phone. Your login and 2FA code are filled in, end-to-end encrypted.
Autofill that can’t be fooled
Matching uses the real domain, so amazon.com.evil.net never gets your Amazon login. Your 2FA code can fill in too.
Private breach check
Find out if a saved password has leaked, without the service ever learning the password or the answer.
Biometric app lock
Unlock with your fingerprint or face, backed by the Android Keystore.
Backups that stay encrypted
Off until you turn it on, then your encrypted vault is copied to your own Google Drive. You can also export an encrypted file.
Bring everything over
Import from the apps you use now, and see exactly what will be added before anything is saved.
Sign in on your computer. Your logins stay on your phone.
Passkeys use the standard FIDO2 way to sign in with a phone, with an extra check that your phone is really there. For passwords, the Keythentic extension for Chrome works the same way: scan, approve, done.
Your computer shows a QR code
On any site that supports passkeys, choose to use a phone.
Scan it and approve
Keythentic opens an end-to-end encrypted tunnel. Only a signed approval crosses it.
Bluetooth confirms you’re there
A Bluetooth LE check proves your phone is beside the computer, so a QR code sent from elsewhere won’t work.
Passwords too: Keythentic for Chrome
Click Keythentic on a sign-in page, scan its code with the app and approve. The username, password and 2FA code are filled in, end-to-end encrypted, and the extension stores nothing.
Bring everything over in one go
Import your logins and 2FA codes from the apps you already use. Before anything is saved, you see what was read, what will be added and what couldn’t be imported. If an app has no export at all, like Authy, Keythentic says so and suggests what you can do instead.
A toolbelt for your passwords
Small tools that run on the page. Nothing you type is sent to us. The breach check is the only one that uses the network, and it shows you the 5 characters first.
Is Keythentic free?
Yes. Install it from Google Play and use it for free.
Can Keythentic read my passwords?
No. Your vault is encrypted on your phone with a key made from your master password (AES-256-GCM, with the key derived by Argon2id). The master password never leaves your device, so we have nothing to decrypt it with.
What happens if I forget my master password?
We can’t reset it, because we never had it. You can set a separate backup passphrase ahead of time, which can also unlock your vault. Keep it somewhere safe and offline.
What if I lose my phone?
If you turned on Google Drive backup or exported an encrypted backup file, install Keythentic on your new phone and restore it with your master password. Without a backup, the vault stays on the lost phone, encrypted.
Can I move my codes from another app?
Yes. Keythentic imports from Google Password Manager, Bitwarden, LastPass, Dashlane, KeePass, Proton Pass, 1Password, Apple Passwords, Aegis and others. Authy has no export, and the app explains what you can do instead.
Is there an iPhone or desktop version?
Keythentic is available for Android today. On a computer, the Keythentic extension for Chrome (also Edge and Brave) signs you in with the logins on your phone: scan its code, approve, and it fills them in. Passkeys work by scanning the QR code your browser shows. A desktop app is on the roadmap.
Are the free tools on this site private?
Yes. They’re plain JavaScript running on the page, and nothing you type is sent to us. They keep working if you go offline after the page loads, except the breach check, which needs to fetch one list of hashes.
Keep your keys where they belong.
Encrypted on your phone, clear about what leaves it, and free.
