Coldvault: Offline Passwords

Coldvault keeps your passwords, one-time codes and notes in a single encrypted file on your phone. There is no account to create, no cloud to sync with, and no server holding your data — because there is no server at all. YOUR PASSWORDS AND YOUR 2FA CODES, IN ONE PLACE Most password managers make you carry a second app for authenticator codes. Coldvault generates them itself. Scan the QR code from any site's two-factor setup page and the codes appear alongside the login they belong to. BUILT TO BE OPENED BY YOU AND NOBODY ELSE • AES-256 encryption on the whole vault file • Your key is derived with Argon2id — deliberately slow, so guessing it is expensive • Your master passphrase is never stored anywhere, on the device or off it • Optional fingerprint unlock, wrapped by your phone's security hardware • Repeated wrong guesses lock the app for longer and longer • The screen is protected from screenshots and the recent-apps preview There is no password reset, and we cannot recover your vault for you. That is not a gap in the product — it is the direct consequence of nobody else holding a key. FILL PASSWORDS IN OTHER APPS Turn on Android autofill and your logins appear above the keyboard in other apps and browsers. An entry saved for one app is offered back only to that app. SHARE A PASSWORD THAT DELETES ITSELF Hand a credential to someone else as a QR code they scan with their own copy of Coldvault. Set how long it lasts, and their app removes it when the time is up. VAULT HEALTH Finds reused, weak and long-unchanged passwords, entirely on your device. Nothing is sent anywhere to be checked. YOU OWN YOUR BACKUP Export an encrypted backup whenever you like, to wherever you like. Import shows you exactly what it will change before it writes anything. WHAT IT COSTS Free for up to 10 logins. One payment, whenever you want more — not a subscription. Nothing renews, nothing expires. Your 2FA codes, notes, export and every other feature are unlimited on both the free and paid versions. ABOUT PERMISSIONS Camera — only to scan QR codes, for two-factor setup and for shared credentials. Fingerprint — only to unlock, if you choose to turn it on. Internet — used only by Google Play's billing library, so the upgrade can be sold. The vault itself never uses the network and your passwords are never transmitted anywhere. We would rather that last permission were not there. It is spelled out here instead of being buried, because a password manager that is vague about its network access has not earned your trust.