PassVault 2026.10.30

What's Changed

⭐ 🆕 New Feature: Autofill for logins (Android, opt-in)

• PassVault can now fill usernames and passwords into other apps and websites. Turn it on in Settings › Security › Autofill. It is off by default.
• Login forms show a locked PassVault suggestion. Tapping it opens a separate unlock screen (app password or biometrics) that lists the logins for that app or site first, fills the one you pick, and locks again.
• Websites are matched by their registrable domain, and only in known browsers. Apps are matched by package or by the app's name, so a record named "Dive+" is suggested for the Dive+ app.
• If you fill a login saved for a different app or site, PassVault asks you to confirm first.
• Apps that sign in with a phone number or account number now get both fields filled.
• Chrome uses an autofill service only after you choose Autofill using another service in Chrome's own settings. The info button next to the Autofill setting lists both steps.

Search and expiry reminders

• Search is now behind a search icon. The search bar hides when you scroll and clears when you switch tabs.
• The expiry reminder is now a slim line that stays visible while any entry has expired or is due within 14 days.

Fixes and polish

• Setting up a vault, changing the password or creating a decoy now says "Passwords don't match" when the two fields differ. Before, the button was just greyed out with no reason given.
• Downloaded update APKs are deleted once installed, so updates no longer fill up the app's cache.

iOS (source only)

• iOS gains the same search and expiry notice, plus Android's auto-lock, clipboard and password generator settings. Encrypted backups now use the app password.
• TOTP links, KeePass dates, CSV, expiry dates and decimal digits are now parsed the same way as on Android.

Project

• Added a privacy policy and a license section (GPL-3.0-only) to the README.
• The release scripts can now build a Google Play bundle signed with the same key as the GitHub APK.

---

PassVault 2026.10.30 (9): Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Source commit: 1cb240e

Full Changelog: v2026.10.26...v2026.10.30

PassVault 2026.10.26

What's Changed

Smoother phone-to-phone transfers

• The animated QR transfer now recovers from missed frames using later ones, so scanning no longer has to wait for a particular frame to come around again. Android and iOS can still receive transfers sent by the previou$
• QR frames change faster. The receiving camera starts at 2× zoom on Android and iOS; Android also refocuses when scanning stalls. On-screen guidance helps you hold the phones at a distance the camera can focus on.
• The one-time transfer code adds dashes as you type it to match the code shown on the old phone.

Easier card entry

• Card numbers and expiry dates are grouped as you type. The separators are shown for readability; only the digits are saved.
• Card expiry dates can be found in search as displayed, such as 02/26. Formatting an existing card number no longer creates a false password-history entry.
• Imports also accept expiry dates written as six digits (MMYYYY).

Clearer vault health report

• Issue groups start collapsed with their counts. Open only the groups you want to review, including individual sets of reused passwords.
• The expiry reminder's Review action opens the expiring-items group directly. Your place in the report is kept when you inspect an entry and return.

---

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: v2026.10.25...v2026.10.26

PassVault 2026.10.25

What's Changed

New record types

• Payment cards: cardholder, number, expiry, security code and PIN. Changes to the card number are kept in password history.
• Secure notes.
• Expiry reminders: any login or note can have a reminder date. Cards use their own expiry. Items that expire within 30 days, or have already expired, get a badge.
• New filter chips and a "new item" menu in the vault list. Cards and notes are never included in CSV exports.

Vault health check

• Finds reused, weak and old passwords, items that have expired or will expire soon, and well-known services that have no saved 2FA code. Gives a score from 0 to 100.
• Runs on the phone only. Passwords are never sent anywhere.

Import from other password managers

• KeePass .kdbx (KDBX 3.1 and 4.x; AES-KDF, Argon2d and Argon2id; AES-256 or ChaCha20; password and/or key file) and KeePass XML, including groups, history, expiry, custom fields and TOTP.
• Bitwarden JSON and CSV, 1Password .1pux and CSV.
• CSV exports from Chrome, Edge, Firefox, Safari, KeePassXC, Dashlane, Proton Pass and others, matched by column names.
• The file format is detected from its content. Imported cards and notes become the new record types, and TOTP keys become 2FA entries.

Move your vault to a new phone

• The old phone shows an animated QR code. The new phone can scan the frames in any order. You can also save a .pvtransfer file instead.
• The transfer is encrypted with a one-time 12-character code. The code is shown only when you ask for it and is never put in the QR codes. No network is used.
• Transfers work in both directions between Android and iOS.

Decoy vault

• Set a second app password to open a separate decoy vault with its own data. Unlocking takes the same time for either password, and 10 failed attempts erase both vaults.
• Biometrics always open the real vault. From the real vault you can reset the decoy's password and keep its entries.

Backup reminders

• Settings shows when an encrypted backup was last saved and lets you set a reminder interval (monthly by default).
• When a backup is due, a banner offers to export now or remind you again in 3 days.

Smaller download

• The release APK is now under 5 MB (it was 12.4 MB).

Fixes

• In-app update no longer tries to install a leftover download that isn't newer than the installed version.
• Imported dates and card expiry years are kept correctly. A card that expired in 1999 is no longer read as expiring in 2099.
• 1Password imports keep every URL. Extra URLs become Website fields.
• KeePass imports refuse key settings that would take too long to open on a phone, and report a damaged file clearly instead of crashing.

---

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: v2026.10.23...v2026.10.25

PassVault 2026.10.23

What's Changed

• Update README for 2FA by @daocha in #10
• Add Android CI workflow and fix API 33 calls in TOTP by @daocha in #11
• Add ios.yml workflow by @daocha in #12
• Add in-app updates for Android release builds by @daocha in #13

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: v2026.10.8...v2026.10.23

PassVault 2026.10.8

What's Changed

• Add 2FA feature by @daocha in #9

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: v2026.10.2...v2026.10.8

PassVault 2026.10.2

What's Changed

• Fix Import duplication and enhance Import feature by @daocha in #8

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: v2026.10.1...v2026.10.2

PassVault 2026.10.1

What's Changed

• Rename package debug/dev build by @daocha in #4
• Update README with banner by @daocha in #5
• Harden backups and key handling; add newer-version errors by @daocha in #7

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: v2026.9.30...v2026.10.1

PassVault 2026.9.30

What's Changed

• PassVault: offline password vault for Android (Compose) and iOS (SwiftUI) by @daocha in #1
• Update release script by @daocha in #2
• Add setup script by @daocha in #3

Android sideload APK (Android 11+). Verify the download against the SHA256SUMS file.

Open source, not independently audited. Everything stays on your device. Keep a separate backup of anything important.

Full Changelog: https://github.com/daocha/password-vault/commits/v2026.9.30