A secure, offline smart password manager for Android with deterministic password generation. Store only metadata — passwords never exist until you generate them.
Decentralized by Design: Unlike traditional password managers that store encrypted vaults on central servers, Smart Password Manager stores nothing. Your secrets never leave your device. Passwords are regenerated on-demand — no cloud, no database, no trust required.
By using this software, you agree to the full disclaimer terms.
Summary: Software provided "AS IS" without warranty. You assume all risks.
Full legal disclaimer: See DISCLAIMER.md
⚠️ This version uses smartpasslib-kotlin v4.0.0, which is NOT backward compatible with v1.x.x
Smart passwords created with older versions cannot be regenerated with v4.0.0.
What changed:
- Dynamic iterations: private key 15-30 steps (was fixed 30), public key 45-60 steps (was fixed 60)
- Expanded Google-compatible character set (26 special chars + A-Z + a-z + 0-9)
- Secret phrases now require minimum 12 characters (was 4)
- Password length now limited to 100 characters (was 1000)
- Key derivation with salt separation ("private"/"public")
- No secret exposure in iteration logs
📖 Full migration instructions → see MIGRATION.md
- Zero-Storage Security: No passwords or secret phrases are ever stored or transmitted
- Decentralized Architecture: No central servers, no cloud dependency, no third-party trust required
- Deterministic Regeneration: Passwords are recreated identically from your secret phrase
- Metadata Only: Store only descriptions and verification keys
- On-Device Generation: All cryptographic operations happen locally on your Android device
- On-Demand Discovery: Passwords exist only when you generate them
- Decentralized & Serverless: No central database, no cloud lock-in, complete user sovereignty
- Smart Password Generation: Deterministic from secret phrase + length
- Offline-First: Works completely without internet connection
- Cross-Platform Compatible: Same passwords as all other SmartPassLib implementations
- Public Key Verification: Verify secret knowledge without exposing the secret
- Material Design UI: Clean, intuitive interface with dark theme support
- 🔍 Instant Search: Quickly find passwords by description as you type
↕️ Drag & Drop Reordering: Customize password order with long press and drag- 📷 QR Code Import: Scan QR codes to import passwords from other devices
- Secure Secret Entry: Hidden input with show/hide toggle
- One-Tap Copy: Copy generated passwords to clipboard instantly
- Export/Import: Backup and restore your password metadata
- Onboarding Guide: Step-by-step introduction for new users
- Expandable Project Cards: Detailed info about ecosystem components
| Main Screen | Splash Screen | Onboarding Guide |
|---|---|---|
 |
 |
 |
- Android 8.0 (API level 26) or higher
- Storage permission (for backup/export functionality)
- Camera permission (for QR code scanning)
- Download the APK from the Releases page
- Enable "Unknown Sources" in your Android settings (if needed)
- Install the APK and open the app
- Read the Legal Disclaimer — you must accept to continue
- Grant Storage Permission — required for saving backups in Documents folder
- Complete the Onboarding Guide — 9 steps explaining everything you need to know
- Start adding your smart passwords!
- Tap the menu button (three dots ⋮) in the toolbar
- Tap the green (+) button to add a new entry
- Enter a description (e.g., "Gmail Account")
- Set password length (12-100 characters, default 16)
- Enter your secret phrase (minimum 12 characters)
- Tap Save — only the public key is stored!
- Tap the 👁️ eye icon on any entry
- Enter your secret phrase (minimum 12 characters)
- Your smart password is generated instantly
- Tap Copy to copy to clipboard
- Tap the search icon (🔍) in the toolbar
- Start typing — results appear instantly as you type
- Search matches are case-insensitive and search through descriptions
- Tap the close (✕) button to clear search and return to full list
- Search preserves your custom order — results maintain their relative positions
- Long press (0.5 seconds) on any password card
- The card will highlight with a blue border + vibration feedback
- Drag the card up or down to reorder
- Other cards will automatically move out of the way
- Release your finger — the new order is saved permanently
- The order persists after app restart and device reboot
- Works even while searching — reorder your filtered results!
Order Storage: Your custom order is saved in a separate order.json file, keeping passwords.json compatible with other platforms.
Import passwords securely via QR codes — perfect for transferring entries between devices.
- Tap the menu button (three dots ⋮) in the toolbar
- Tap the QR Scan button (📷 icon)
- Grant camera permission when prompted
- Scan QR code containing password length and public key
- Enter your secret phrase to verify ownership
- Add description for the imported entry
- Save — password is ready to use!
QR Code Format:
{
"l": 16,
"k": "a3f5c8e2d1b4a7c9e6f3b8d2a5c7e9f1b4d6a8c2e5f7b9d3a6c8e1f4b7d9a2c5e8f1"
}l= Password length (12-100 characters)k= Public key (64-character hex string)
Features:
- Continuous autofocus for best scanning results
- Audio feedback (success/error sounds)
- Duplicate detection prevents adding the same secret phrase twice
- Character counter with color-coded indicator for description input
Generate QR codes using any SmartPassLib implementation
- Edit — Tap the ✏️ pencil icon to change description or length only
- Delete — Tap the 🗑️ trash icon to remove an entry
⚠️ Note: Secret phrase cannot be changed — you must delete and recreate
- Export — Use the ⋮ menu to backup your metadata to Documents folder
- Import — Restore from previously exported backup
- Format: JSON file containing descriptions, public keys, and lengths
| Step | Operation | Location | Stored? |
|---|---|---|---|
| 1 | Enter secret phrase | Your mind | ❌ Never |
| 2 | Generate private key (15-30 iter) | RAM only | ❌ Never |
| 3 | Generate public key (45-60 iter) | Device | ✅ Stored |
| 4 | Generate password from private key | RAM only | ❌ Never |
| Key Type | Iterations | Purpose | Stored? |
|---|---|---|---|
| Private Key | 15-30 (dynamic) | Password generation | ❌ Never |
| Public Key | 45-60 (dynamic) | Secret verification (proof of knowledge) | ✅ Yes |
!@#$%^&*()_+-=[]{};:,.<>?/ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz
| Field | Minimum | Default | Maximum |
|---|---|---|---|
| Secret phrase | 12 chars | - | unlimited |
| Password length | 12 chars | 16 chars | 100 chars |
| Description | 1 char | - | 255 chars |
- Minimum 12 characters (strictly enforced)
- Case-sensitive
- Use a mix of: uppercase, lowercase, numbers, symbols, emoji, or Cyrillic
- Never store digitally
- NEVER use your password description as your secret phrase
✅ "MyStrongSecretPhrase2026!" — mixed case + numbers + symbols
✅ "P@ssw0rd!LongSecret" — special chars + numbers + length
✅ "КотБегемот2026НаДиете" — Cyrillic + numbers
❌ "Gmail Account" — using description as secret
❌ "password" — dictionary word, too short
❌ "1234567890" — only digits, too short
❌ "qwerty123" — keyboard pattern
❌ Same as description — never use the same as description
There is no "forgot password" button. This is by design:
- No central server can reset your passwords
- No support team can recover your access
- Your secret phrase is the ONLY key
This is the price of true decentralization — you are completely in control.
- Secret phrases are NEVER stored — if forgotten, passwords cannot be recovered
- Smart passwords are NEVER stored — they only exist when generated
- Same secret + same length = same password everywhere (cross-platform!)
- Export your metadata regularly as backup
The old passwords.json file is NOT compatible with v4.0.0
Public keys stored in v1.x.x files cannot be used with v4.0.0 because:
- Iteration counts changed from fixed 60 to dynamic 45-60
- Salt "public" was added to key derivation
Result: Old entries cannot be verified. Passwords cannot be regenerated.
No automatic migration is provided — you need to recreate entries manually. See MIGRATION.md for detailed instructions.
- Pointer-Based Security Paradigm — Architectural Shift from Data Protection to Data Non-Existence
- Local Data Regeneration Paradigm — Ontological Shift from Data Transmission to Synchronous State Discovery
Powered by smartpasslib-kotlin v4.0.0+ — Native Kotlin implementation of deterministic password generation.
Cryptographic Specifications (v4.0.0):
| Component | Specification |
|---|---|
| Hash Algorithm | SHA-256 |
| Private Key Iterations | 15-30 (dynamic, per secret) |
| Public Key Iterations | 45-60 (dynamic, per secret) |
| Key Derivation Salt | "private"/"public" |
| Password Generation | Deterministic from private key |
| Min Secret Length | 12 characters |
| Password Length Range | 12-100 characters |
Decentralized Architecture:
- No central authority required
- Metadata can be synced via any channel
- Your security depends only on your secret phrase
- Works offline — no internet connection required
| Permission | Required For |
|---|---|
| CAMERA | QR code scanning |
| MANAGE_EXTERNAL_STORAGE (Android 11+) | Saving backups to Documents folder |
| WRITE_EXTERNAL_STORAGE (Android 10-) | Export/Import functionality |
Note: Storage permission is required for backup/export only. Camera permission is required only for QR scanning. The app works completely offline and never transmits data.
| Type | Path |
|---|---|
| Metadata file | Documents/smart_password_manager_android/passwords.json |
| Order file | Documents/smart_password_manager_android/order.json |
Export files are saved to the same directory with timestamp: passwords_export_YYYYMMDD_HHMMSS.json
| Version | smartpasslib-kotlin | Status | Migration Required |
|---|---|---|---|
| v1.x.x and below | v1.x.x | ❌ Deprecated/Unsupported | Must migrate to v4.x.x |
| v4.0.0+ | v4.0.0+ | ✅ Current | N/A |
Smart Password Manager Android produces identical passwords to:
| Platform | Application |
|---|---|
| Web | Web Manager |
| Desktop | Desktop Manager |
| CLI | CLI PassMan / CLI PassGen |
| Python | smartpasslib |
| Go | smartpasslib-go |
| Kotlin | smartpasslib-kotlin |
| JavaScript | smartpasslib-js |
| C# | smartpasslib-csharp |
Data transfer: Use QR codes or Export/Import to sync metadata across all platforms.
This Android application is part of a comprehensive suite:
- smartpasslib — Python
- smartpasslib-js — JavaScript
- smartpasslib-kotlin — Kotlin (used in this app)
- smartpasslib-go — Go
- smartpasslib-csharp — C#
CLI Applications:
- CLI Smart Password Manager (Python)
- CLI Smart Password Generator (Python)
- CLI Smart Password Manager (C#)
- CLI Smart Password Generator (C#)
Desktop Applications:
Other:
- Password Cards — List of all your smart password entries
- Description — Your custom label for each entry (expandable if >20 chars)
- Length — Shows password length in symbols
- Public Key Preview — First 12 chars of verification key
| Button | Action |
|---|---|
| 🔍 Search | Open search bar to filter passwords |
| ⋮ (Menu) | Open menu with Add, QR Scan, Export, Import, Help, About |
| ← (Back) | Navigate back (when applicable) |
| Button | Action |
|---|---|
| ✕ (Close) | Clear search and return to full list |
| Typing | Instant filtering by description |
| Option | Action |
|---|---|
| + Add | Create new smart password entry |
| QR Scan | Import password via QR code |
| Export | Backup all metadata to JSON file |
| Import | Restore metadata from backup |
| Help | Open help documentation |
| About | Show app info and ecosystem links |
| Button | Action |
|---|---|
| 👁️ Eye | Generate and display smart password (requires secret) |
| ✏️ Edit | Change description or length (secret cannot change) |
| 🗑️ Delete | Remove entry permanently |
| ▼/▲ Arrow | Expand/collapse long description (>20 chars) |
| Action | Result |
|---|---|
| Long press (0.5 sec) on any card | Card highlights blue + vibration |
| Drag up/down | Cards reorder automatically |
| Release finger | New order saved permanently |
- Android Studio Hedgehog | 2023.1.1 or higher
- JDK 11 or higher
- Android SDK with API 34
# Clone the repository
git clone https://github.com/smartlegionlab/smart-password-manager-android.git
# Open in Android Studio
# Wait for Gradle sync to complete
# Build the APK
./gradlew assembleDebugBSD 3-Clause License
Copyright (©) 2026, Alexander Suvorov. All right reserved.
Alexander Suvorov — GitHub
- Issues: GitHub Issues
- Core Library Issues: smartpasslib Issues
- Migration Questions: See MIGRATION.md
Ecosystem: See links on About screen
Made with ❤️ for privacy and security