Decryptum v1.2.0 — Autofill, passkeys & security

v1.2.0 · versionCode 9 · Android 8.0+ · prerelease.

Автозаполнение сопоставляет записи по точному пакету приложения, предлагает аккаунты в один тап, копирует 2FA-код после заполнения и обновляет существующие записи вместо дублей. Passkeys снова работают через Credential Manager, в том числе для нативных приложений через Digital Asset Links.

Большой проход по безопасности: повторная проверка мастер-пароля перед CSV-экспортом, нарастающая блокировка после неудачных попыток, автоблокировка при переводе часов назад, логи без имён пользователей и доменов. Исправлены импорт (Bitwarden JSON, несколько URI и passkeys, Steam Guard), TOTP/HOTP и десятки мелких ошибок. Claude отключён в release APK.

Скачивание: Decryptum-v1.2.0.apk ниже. SHA256SUMS.txt идентифицирует точный файл; BUILD_VERIFICATION.md описывает проверки сборки. Инструментальные тесты прошли на реальном устройстве (OnePlus CPH2653, Android 16). v1.1.0 остаётся полноценным релизом.

Подпись APK — Android Debug, та же, что у v1.1.0 и v1.1.1. Обновление поверх старой установки не проверялось. Зашифрованное переносимое восстановление ещё не реализовано; CSV-экспорт открытый, passkeys экспериментальные. Не удаляйте важное хранилище ради установки; сохраняйте независимые способы восстановления аккаунтов.

Что изменилось · Changelog · Проверка APK · Безопасность · Сайт

Decryptum v1.1.1

v1.1.1 · versionCode 8 · Android 8.0+ · prerelease.

Локальное хранилище, генератор паролей на SecureRandom, TOTP, Android autofill и Security Center с проверкой слабых, повторяющихся паролей и дубликатов.

Укреплена изоляция четырёхчислового контракта и debug-компонентов Claude Advisor. Claude отключён в release APK. Обновлены README и публичный сайт.

Скачивание: Decryptum-v1.1.1.apk ниже. SHA256SUMS.txt идентифицирует точный файл; BUILD_VERIFICATION.md описывает проверки сборки. v1.1.0 опубликован как полноценный релиз.

Подпись APK — Android Debug. Зашифрованное переносимое восстановление ещё не реализовано; CSV-экспорт открытый, passkeys экспериментальные. Установка/обновление, совместимость autofill, native storage/crypto и доступность требуют проверки на устройстве. Не удаляйте важное хранилище ради установки; сохраняйте независимые способы восстановления аккаунтов.

Что изменилось · Проверка APK · Безопасность · Сайт

Decryptum v1.1.0 — Security Center & Material 3

Добавлены локальный Security Center, новая форма добавления пароля и обновлённый Material 3. Исправлены переключение вкладок и эффект нажатия.

Сайт Decryptum · Русский README

---

Decryptum v1.1.0 — Security & Product Polish

Public release · versionCode 7 · 2026-10-08. See artifact verification and known limitations.

This release adds useful local security checks and improves the vault interface while tightening several storage and authorization paths. It does not establish complete Android runtime safety or recovery.

User-facing changes

• Security Center: inspect weak-password heuristics, exact password reuse across stored account identities, and exact duplicate credentials. Open affected entries and decide what to change manually. Checks run locally; no records are automatically deleted.
• Material 3 polish: updated fallback colors and clearer vault/TOTP/detail components, dialogs and EN/RU labels. Existing navigation and dynamic colors remain.
• Honest check states: breach status is not checked/unavailable; no global security score, certified entropy, password-age or complete 2FA/passkey coverage is implied.
• Autofill authorization: the picker lists metadata only, then reads the selected password after authentication. Unavailable biometrics use master-password fallback instead of bypassing mandatory auth. Password Credential Manager uses the same fallback; passkey auth no longer skips required verification when biometrics are unavailable.
• Fresh master verification: a wrong password is rejected even during an already unlocked session.
• Storage repair: migration preserves schema version, checkpoints WAL, validates encrypted export and uses atomic replacement. Failure to persist the DB key stops database use instead of risking an unrecoverable encrypted database. Android migration fixtures are provided; native execution is still required.

Navigation and password entry

• Fixed the start-tab saved-stack alias: tapping Passwords always returns to the vault instead of reopening a saved Security Center/generator branch. Security Center's generator shortcut uses the same navigation action as the bar; other tab restoration stays enabled.
• Removed screen crossfades and opaque-background gaps that showed multiple tab contents at once. Bottom-bar press feedback is clipped to each rounded tab.
• Replaced the old add-password alert with a native Material 3 modal sheet. Service/login/password, local generation, existing optional strength display, show/hide, Next/Done keyboard actions and scrollable controls follow existing EN/RU themes.
• Saving waits for persistence, prevents repeated taps, retains inputs after a failed write and displays a localized retry message. Service/login outer whitespace is trimmed; password characters and spaces are preserved exactly. Credentials are not placed in saved-instance state, analytics or logs.
• VersionCode 7 updates the previous private versionCode 6 candidate and public v1.0.1/versionCode 5. See the artifact verification.

Optional Security Advisor

Claude guidance is a debug prototype and disabled in this release APK. Configured debug requests require fresh consent and show the exact payload: only password_entry_count, weak_password_count, reused_password_count, duplicate_credential_count. Counts can still be sensitive; IP/timing/provider metadata are also disclosed. No passwords, hashes, identities, domains, TOTP secrets or private keys enter the AI payload. No live-provider request was performed. Production access is deferred until credential/backend and privacy review.

Privacy and known limitations

Core vault, generator, TOTP generation and local checks operate offline. Favicons can contact third parties and the toggle does not cover every caller. Automatic HIBP loading/edit checks are disconnected. Selected credentials can leave via Android integration; readable CSV can expose passwords, TOTP and private passkeys through the chosen document provider.

Passkeys remain experimental software P-256 credentials. Caller/origin/RP binding, challenge/allowCredentials correctness and interoperability remain launch blockers. CSV/JSON is not a tested encrypted recovery format: TOTP-only/standalone passkey restore, exact secret preservation, linked edits and legacy upgrades still need work. Developer cleanup can affect real records; do not use it on important data.

JVM tests and APK assembly are not evidence of native SQLCipher/Keystore, biometrics, process-death behavior, TalkBack or device compatibility. Use disposable data while these limitations remain open and maintain independent account recovery methods. No independent security audit, guaranteed memory erasure or universally hardware-backed protection is claimed.

Upgrade and signing notes

Application ID stays com.doffi4.doffisecure; versionCode increases from 5 to 7. Public v1.0.1 release APK and this v1.1.0 APK share certificate SHA-256 93965360a3a6903851cecddb9370eab62afc269ec107cce9b472190ea99b76fa. Both use an Android Debug signing identity. Matching signatures permit update identity continuity; actual installation/upgrade/data retention has not been tested.

Do not uninstall or reset an existing vault to solve an install error: Keystore loss can destroy access. Do not treat CSV as a proven complete recovery copy. Test upgrades using copied synthetic fixtures or a disposable Android profile/device before important data. Public signing policy/key custody still requires an owner decision; changing certificates without a supported rotation plan can prevent updates.

Download Decryptum-v1.1.0.apk from the v1.1.0 release. APK SHA-256: 5fe57baa958da5fc48d8c90dcf31fc1cf5862b6a00053a14e17068c142d32c95. Checksums and verification notes accompany the release. Website: doffi4.github.io/Decryptum. Source is included in the repository; no custom domain is configured.

Decryptum v1.0.1

[1.0.1] - 2026-09-08

Changed

• Redesigned Autofill Bottom Sheet (AutofillPickerActivity) to full Material 3 standards:
  • Account cards styled with clean outlines (outlineVariant), surfaceContainerHigh container fill, and native ripple feedback.
  • Compact dialog height with removed redundant "Later" button.
  • Added Material 3 filled tonal close button (12dp rounded square container).
• Branded Gboard suggestion chip:
  • Added transparent-background Decryptum shield brand vector icon (ic_autofill_decryptum).
  • Updated chip action text to "Search in Decryptum" / "Искать в Decryptum".
• Added org.gradle.daemon=false to gradle.properties to prevent Windows file-lock issues during build.
• Bumped version to 1.0.1 (versionCode 5).

Decryptum v1.0.0

[1.0.0] - 2026-09-08

Added

• Implemented Passkey (FIDO2 / WebAuthn) registration and authentication using AndroidX Credentials API.
• Implemented hardware-backed ECDSA P-256 keypair generation in Android Keystore.
• Added native CBOR encoder and WebAuthn authenticator response parser.
• Added built-in RFC 6238 TOTP authenticator with SHA-1, SHA-256, and SHA-512 support.
• Added live QR code scanning via CameraX and ML Kit Barcode Scanning.
• Added QR code image parser with ZXing fallback.
• Added Google Authenticator migration export parser (otpauth-migration://).
• Added HaveIBeenPwned breach detection using k-Anonymity SHA-1 prefix API.
• Added automated unit test suites for TOTP, WebAuthn, CBOR, SQLCipher migration, and rate limiting.

Security

• Integrated SQLCipher 4.6.1 for full page-level AES-256 database encryption.
• Added automatic SQLite-to-SQLCipher migration mechanism (DatabaseMigrator).
• Migrated master password derivation to Argon2id (RFC 9106) via �rgon2kt.
• Added ClipDescription.EXTRA_IS_SENSITIVE on Android 13+ to suppress clipboard previews.
• Implemented ClipboardClearReceiver via AlarmManager for reliable background clipboard wiping.
• Replaced pre-unlock lock screen network requests with local IcoDecoder and deferred favicon fetching.

Changed

• Migrated credential saving to dedicated AutofillSaveActivity and Credential Provider flow.
• Optimized R8 shrinking rules and Baseline Profiles for faster cold start.
• Bumped version to 1.0.0 (versionCode 4).

Decryptum v0.9.0

[0.9.0] - 2026-09-05

Added

• Implemented Android AutofillService with inline IME keyboard suggestions.
• Added Material 3 bottom sheet picker for account selection.
• Added strict form analysis (AutofillStructureParser) to filter non-login input fields.
• Added per-app language selection (English, Ukrainian, Russian) with Android 13+ LocaleManager support.

Changed

• Bumped version to 0.9.0 (versionCode 2).
• Reduced APK size using R8 code and resource shrinking.

Decryptum v0.8.0

[0.8.0] - 2026-09-04

Added

• Initial release.
• Android Keystore AES-GCM envelope encryption.
• Biometric unlock (BiometricPrompt) with auto-lock timer.
• Password generator with entropy calculation and customization options.
• CSV import and export compatible with Bitwarden, KeePass, Chrome, and LastPass.
• Material You dynamic theming and custom bottom navigation.
• Diagnostic overlay for development mode (FPS and frame drop metrics).