Stash

An offline-first encrypted vault for the secrets developers use every day: env files, API keys, tokens, database URLs, SSH keys, logins and 2FA codes. No account, no server, no analytics, no ads.

Google Play Privacy policy Support · labyrinthcode10@gmail.com

Role: Design, code, release
Platforms: Android · iOS · Chrome
Core stack: Kotlin Multiplatform
Status: Android on Google Play. iOS builds, not on the App Store yet. App 1.2.0, Chrome extension 1.1.0

Screens

Chrome extension

What it does

Dev secrets

Env files, API keys, SSH keys, database URLs, logins, notes and 2FA, each with its own form. Folders, #tags and search.

Offline first

A SQLCipher database whose key is wrapped by Argon2id from your passphrase. Biometric unlock through Android Keystore or iOS Keychain.

Optional E2E sync

Syncs phones and Chrome through a hidden appDataFolder in your own Google Drive. Google only stores ciphertext.

Vault health

Flags duplicate, reused and weak passwords. An opt-in breach check asks Have I Been Pwned with only 5 characters of a SHA-1 hash.

Autofill

Android AutofillService and an iOS credential provider extension. Several URLs per login and equivalent domains.

2FA codes

TOTP codes next to their login, from a QR scan, a typed key or a Google Authenticator export. Copied after autofill.

Stash for Chrome

Fills and saves website logins from the synced vault: popup, inline menu in the login field, or Ctrl/Cmd+Shift+L. Copies 2FA codes, generates passwords.

Backups

Encrypted .vault files open on Android or iOS with the passphrase. The vault also rides in the phone's own backup, still encrypted.

Import and export

From Google Password Manager, Bitwarden, 1Password, Apple Passwords and KeePassXC. Out to Bitwarden JSON or Google CSV. Credential Exchange (FIDO CXF) on Android and iOS 26+.

How it's built

Layer	Tech	Notes
Shared core	Kotlin 2.4 Multiplatform, Room KMP on SQLCipher	Argon2id + AES-256-GCM, coroutines/Flow, kotlinx.serialization, SKIE for Swift interop, vault health analyzer
Android	Jetpack Compose, Material 3	CameraX + ZXing, Keystore/BiometricPrompt, AutofillService, Credential Exchange (providerevents)
iOS	SwiftUI (iOS 17+)	Argon2 C bridged to Swift, Keychain, Face ID/Touch ID, AVFoundation QR scan, AutoFill credential provider extension, Credential Exchange (iOS 26+)
Chrome	Manifest V3, TypeScript, Vite	hash-wasm (Argon2) is the only runtime dependency; service worker, popup, offscreen clipboard page, inline login menu in an extension frame, TOTP and generator ported from the app
Sync	Google Drive appDataFolder	drive.appdata scope only; one AES-256-GCM file per device, merged per item by Lamport revision; ciphertext only
Breach check	Have I Been Pwned range API	Opt-in, phones only; SHA-1 on device, 5-character prefix sent, padded replies, match checked on device

Privacy

Works offline. Only two opt-in features use the network: sync and the breach check.
Sync sends only ciphertext, to a hidden app folder in your own Google Drive.
The breach check sends the first 5 characters of a SHA-1 hash. Matching happens on the device.
Phone backups carry the vault still encrypted with your passphrase.
No Stash account and no Stash server.
No analytics, ads, crash reporting or tracking.

Full details: Stash privacy policy