Keythentic
Get the app
Home / What’s new

What’s new

What changed in each Keythentic release, newest first.

0.12.1

Find computer sign-in from the app. Settings › Sign in on a computer explains the Keythentic extension for Chrome, lets you share or copy its link to your computer, and opens the scanner. A one-time card on the home screen points to it.

0.12.0

Sign in on your computer with your phone. Install the new Keythentic extension for Chrome, click it on a sign-in page, and scan the code with the scan button at the top of the app. Your phone shows the site and a check code that matches the one on the computer; approve with your fingerprint and the username, password and current 2FA code are filled in.

Everything between the phone and the computer is end-to-end encrypted with fresh keys for each sign-in, and the extension stores no passwords, keys or history. You can also send a login you typed on the computer to your phone to save it, once you've checked the codes match.

0.11.1

A scan button at the top of the home screen, next to search, on both the Codes and Vault tabs and in every theme. Scan the QR code a computer shows to sign in there with one of your passkeys, or a site's two-factor setup code to add it.

0.11.0

New protections in Settings › Security. Every one of them is off until you turn it on.

Duress password. A second password for when someone makes you unlock. Type it instead of your master password and Keythentic opens a decoy vault, looking like any normal unlock. You can also choose to have it erase the real vault first. Your next real unlock tells you it was used.

Emergency access. Give someone you trust an emergency code. When they enter it on your phone you get a notification, and your vault opens to them after a waiting period of one day to a week, unless you decline.

Travel mode. Take chosen folders off the vault before a border crossing. They're sealed with your master password until you bring them back, and Google Drive backup pauses meanwhile.

Hide codes until tapped, PIN unlock, and an option to confirm it's you before a password is shown. Fingerprint and PIN unlock now ask for the master password every two weeks (you can change or turn this off in App Lock), so you don't forget it.

Share a login securely as an encrypted file that opens with a one-time passphrase.

Also: Security check now looks at the phone itself (screen lock, and whether the system was modified), backup reminders tell you when your backup is old or failing, the keyboard is asked not to learn anything typed in the app, other apps can't draw over it, and fingerprint keys use the phone's StrongBox chip where there is one.

0.10.1

An app icon to match your theme. Pick Midnight, Daylight or Bento in Settings › Theme and the icon on your home screen follows: lime for Midnight, teal for Daylight, yellow on black for Bento. It changes once you leave the app.

0.10.0

Security check. Settings › Security › Security check gives your vault a score and lists what to fix: breached, reused, weak and year-old passwords, sites that were breached after you last changed the password, and sites where you could turn on 2FA or a passkey. "Check all" runs the breach check over every password, sending only the first 5 characters of each hash. The rest is worked out on your phone from lists that ship with the app.

Harder to guess your way in. After five wrong master passwords the app makes you wait, longer each time, up to 15 minutes, and the next unlock tells you how many wrong attempts there were. You can also choose to erase the vault on the phone after 10, 15 or 20 wrong attempts in a row.

Lock in a hurry. Lock as soon as the screen turns off, or from a new Quick Settings tile.

Change your master password from Settings › Security. Your saved items aren't touched.

Recovery codes and files. Keep a login's 2FA recovery codes with it, and attach files of up to 5 MB to logins and notes. They're encrypted with the rest of the vault.

Backup test and emergency kit. Check that a Drive backup or backup file opens and holds everything, without restoring it, and print a one-page PDF of recovery steps (it contains no secrets).

Smaller and more private. QR scanning now uses ZXing instead of Google's ML Kit, which sent usage logs to Google. The app is about 5 MB instead of 27 MB. The welcome, setup and unlock screens are redesigned, and search is ready to type into as soon as you open it.

0.9.0

Three themes to choose from. Settings › Preferences › Theme switches the whole app at once. Midnight, the new default, is dark with a lime accent: your codes in a plain list under a single countdown. Daylight is light and calm, with your top code on its own card and the rest in grouped lists. Bento lays your codes out as bold coloured tiles.

Light or dark, your call. Daylight and Bento each come in light and dark and follow the Appearance setting; Midnight is always dark. Every screen follows the theme you pick, from unlock to settings, and the app has a new icon to match.

One add button. On the Vault tab it asks whether you're adding a login, a card or a note. On Codes, tap a code to copy it and hold it for details, edit and delete.

0.8.1

A redesigned app. New colours, type and layouts across every screen, with summary cards on Codes and Vault and quick actions for adding things. (0.8.0 was replaced by this release before it reached anyone.)

A smaller download. The app is now built with code shrinking, which takes it from about 45 MB to 27 MB on your phone.

0.7.1

Autofill your 2FA codes, not just passwords. If a saved login carries its own authenticator key, Keythentic now offers its current code on the site’s one-time-code field too — as a keyboard suggestion or in the autofill sheet, right alongside the username and password.

Generated at the tap, not cached. The code is produced the instant you choose the suggestion, so it is never stale by the time it lands in the field — unlike a code baked in when the suggestion first appeared, which could already be seconds old. Split code boxes (one digit per box) are left alone on purpose: filling a whole code into the first box would look filled and be wrong.

0.7.0

Find duplicate logins. Settings › Backup › Find duplicate logins groups saved logins that share a username and the same website or app. Where one copy already holds everything the others do, Keythentic offers to remove the extras — and tells you exactly what it keeps and what it drops before you confirm.

It stops where it can't be sure. When two copies hold different passwords, Keythentic won't merge or delete them: it cannot tell which one the site still accepts, and the newest entry is not necessarily the working one. It shows you both, lets you reveal and copy each, and leaves the decision with you. Deleting a login can't be undone — Keythentic has no trash, and every confirmation says so.

0.6.4

Hardening, after a full security review. The passkey rows Android shows you are now tied to the credential they name, so another app running in the background cannot make the row you tap use a different one. Keythentic also no longer reveals which sites you have saved to an app that asks: it used to answer that question simply by whether a suggestion appeared, which let an app read your whole list of sites without any permission. And a damaged or deliberately malformed import file is now refused cleanly instead of crashing the app.

A fix worth naming. Editing a saved card or note could quietly clear its folder and several other details, because the edit rebuilt the record from scratch rather than updating it. No card or note in a released build could have carried a folder yet, so nothing was lost — but it would have started losing things the moment folders reached them.

0.6.3

Security fix — another app could pose as a browser. Keythentic decided whether a request came from a browser by asking Android which apps can open web links. An app can simply declare that it can, so a malicious app could claim to be a browser, tell Keythentic it was showing amazon.com, and be offered that saved password without the warning Keythentic shows for apps it does not recognise. Keythentic now checks the browser’s signature, and shows a confirmation naming the app whenever it cannot confirm one. If you use a less common browser you may see that confirmation before a fill. Nothing stored on your device was exposed, and no password could be read without you tapping it.

0.6.2

Security fix — passkey sign-in. When a browser signs you in with a passkey it hands Keythentic the exact details to sign. Keythentic accepted those details from any app that offered them, rather than only from a caller Android itself had verified as a browser — so an app on your device could have asked Keythentic to sign a login for a site you hold a passkey for. Keythentic now only accepts them when Android has verified the caller, and refuses to sign in to any site other than the one the request named. Your passkeys themselves were never readable by another app, and nothing stored on your device was exposed.

0.6.1

Autofill works on websites again. Keythentic could fill your username on a web page but never your password: the password box was not being recognised at all in Chrome or any other browser. Saved logins also failed to appear in the suggestion list even when they matched the site. Both are fixed, and saved logins now appear as chips in the keyboard’s suggestion strip as well as in the dropdown. Autofill inside native apps was never affected.

0.6.0

Import from another password manager. Settings › Backup › Import brings your logins and authenticator codes over from Google Password Manager, Bitwarden, LastPass, Dashlane, KeePass, Proton Pass, 1Password, Apple Passwords, Aegis and others. You see exactly what Keythentic understood — how many records it read, how many it will add, and what it could not read — before anything is saved.

It tells you what it cannot do. Authy has no export at all: Twilio built it so that no app, including Authy itself, can hand your codes to anything else. Keythentic lists Authy anyway and says so, with the steps that do work, rather than leaving you to find that out. Microsoft Authenticator is the same. An encrypted export is refused rather than asking you to make an unprotected copy of every password you own.

And it reminds you to delete the file. Every export is your passwords in plain text. Keythentic reads it once, copies it nowhere, and offers to delete it when the import finishes.

0.5.0

All your codes in one place. An authenticator code saved on a vault login now also appears in the TOTP tab, so you no longer have to remember which of the two places a code lives in. Each login has its own switch for this on its edit page, because a code you only ever use inside one saved login does not need to be on the main list.

Scan a passkey QR from the home screen. Signing in to a computer with a passkey on your phone used to be five taps deep in Settings. The QR a desktop browser shows expires, so it is now one tap from the home screen.

Service logos update themselves. The list of brands Keythentic recognises is now published by us and refreshed about once a week, so a newly added logo reaches you without waiting for an app update. Your phone still matches what you typed against that list locally — the account name you wrote never leaves your device.

Optional in-app announcements. Off unless you switch them on, at most one check a day, and the request carries nothing about you or your vault.

Earlier closed-testing builds

These landed across the builds before 0.5.0 and are all in the current release:

  • A proper page for every login. Logins gained view and edit pages grouped into cards, with a password generator, a strength meter, folders, and the authenticator code attached to the login it belongs to.
  • Autofill for apps and websites. One saved login can match several websites and several Android apps at once. Matching is anchored to the real registrable domain, so a lookalike like amazon.com.evil.net never matches your Amazon login.
  • A breach check that never sees your password. Only the first five characters of its SHA‑1 hash leave your phone, the comparison happens on your device, and it runs when you tap it rather than on its own.
  • Automatic backup to your own Google Drive, on an interval you choose and off until you turn it on. What uploads is the already-encrypted vault file, so it is never decrypted to be backed up.
  • Brand logos for your accounts, off by default, fetched one at a time and kept on your device afterwards.
  • Favicon fetching removed. Keythentic used to load account icons from a third-party favicon service, which quietly told that service every site in your vault. That is gone; see what leaves your device for the full list.
  • In-app updates, so a new build can be installed without leaving the app.

Every network request Keythentic makes is listed on the security page, and everything above that touches the network is off until you switch it on.