Vaultify
Strong passwords, kept in an encrypted vault on your own device. No account. No sync. No internet.
What you can install today
| Platform | File | Status |
|---|---|---|
| Windows 10 / 11 | Vaultify-<version>-Setup.exe |
Supported. Installs for the current user, no admin needed. |
| Android 10 or newer | Vaultify-<version>.apk |
Supported. Install the APK directly; not on Google Play yet. |
| macOS | Vaultify-<version>.dmg |
Preview. Builds and runs, but is unsigned and not yet tested on a Mac. |
| iOS | Vaultify-<version>-ios-unsigned.zip |
Preview. Unsigned, so it cannot be installed from here yet. |
Windows shows a blue warning the first time
Vaultify is not code-signed yet, so Windows SmartScreen says the publisher is unknown. To continue: More info → Run anyway. If you would rather not, you can build it yourself from source — the build workflow is the same one that produces these files. How signing is handled, and who can authorise it, is set out in the code signing policy.
Android asks permission to install the APK
Because the app does not come from the Play Store, Android asks you to allow
installs from your browser or file manager once. Open the downloaded
.apk, then allow the prompt that appears.
Checking that your download is intact
Every release page lists the SHA-256 hash of each file, so you
can confirm the one you downloaded is the one that was built. In PowerShell:
Get-FileHash .\Vaultify-1.0.0-Setup.exe -Algorithm SHA256. If it does
not match, delete the file and download it again. See the
code signing policy for the details.
What it does
- Generates passwords with the character sets you choose, using your system's secure random source.
- Keeps them in one encrypted vault file, unlocked by a PIN or password.
- Shows live two-factor codes for accounts that use them, added by scanning a QR code or pasting a key.
- Locks itself when idle, clears the clipboard, and blocks screenshots on Android.
- Exports an encrypted backup you can carry to another device.
Privacy, briefly
Vaultify has no servers, because it never connects to anything. The Android release build is not even granted internet permission, so the app cannot send your data anywhere, whether or not you believe this page. Nothing is collected, and there is no analytics or crash reporting.
How your vault is protected
Your PIN or password is turned into an encryption key with Argon2id, a function deliberately slow and memory-hungry to make guessing expensive. The vault itself is encrypted with AES-GCM, which also detects tampering: a modified vault file fails to open rather than opening with wrong contents.
Your PIN is never stored, so it cannot be read off the device — and it also cannot be recovered. If you forget it, the vault is unreadable. Keep an encrypted backup.