K Keythentic

Security architecture

A high-level, honest look at how your data is protected — no marketing fluff.

The short version

Keythentic encrypts your vault on your device, using a key derived from your master password, before anything is written to storage or backed up anywhere. We designed it this way so that Keythentic itself — including the developer — never has the ability to read your vault, whether or not you ever back it up.

Client-side, end-to-end encryption

Your master password never leaves your device. It's run through a modern, memory-hard password-hashing algorithm (Argon2id) to derive an encryption key, which in turn protects your vault contents — TOTP secrets, saved logins, cards, secure notes, and passkeys — using AES-256-GCM authenticated encryption. All of this happens locally, on your phone.

We're deliberately not publishing exact parameters (iteration counts, memory costs, and similar low-level specifics) on this public page, both because they may change between versions and because that level of detail belongs in a technical security write-up rather than a marketing site. The architecture itself — client-side key derivation, authenticated symmetric encryption, no server-side key custody — is what matters for understanding what we can and can't access.

No server-side key custody

Keythentic does not operate an account or sync server today. There is nothing to breach on our end that would expose your vault, because your vault and your master password never reach any server we run in the first place.

What this means in practice: if you forget your master password, we cannot recover your vault for you. There is no "reset password and keep your data" flow, because that would require someone — us — to be able to decrypt your vault, which is exactly what this design avoids.

Backups stay encrypted

If you back up to your own Google Drive, the file uploaded is your already-encrypted vault — the same encrypted blob that lives on your device, uploaded as-is to a private, app-specific area of your own Drive that isn't visible in your regular Drive file list. Keythentic's developer has no access to your Google Drive or to that file. The same is true of local encrypted export: the file you save is encrypted before it touches your device's storage.

Biometric unlock uses your device's hardware, not ours

Fingerprint and face unlock are handled entirely by Android's own biometric APIs and the Android Keystore. Your biometric data is processed and stored by your device's secure hardware — it is never sent to Keythentic, and we never see it.

Acting as an Autofill and passkey provider

When you enable Keythentic as your Android Autofill service or as a Credential Manager (passkey) provider, Android grants it the ability to read the on-screen fields of the app or site you're filling into (so it can offer or save a matching credential) and to respond to passkey requests on your behalf. This is the same model every password manager and passkey provider on Android uses, it's controlled entirely by you through Android's own Settings, and it doesn't change how your vault itself is encrypted or stored.

Open about what we haven't done yet

Keythentic is an early-stage, single-developer product. We have not yet commissioned a formal third-party security audit — that's on the roadmap as the product matures, and we'll update this page when it happens. We'd rather tell you honestly where things stand than overstate our security posture.

Questions about this architecture? Get in touch — we're happy to talk through it.