Skip to content

pwagen 1.0

Choose a tag to compare

View all tags
@ddagunts ddagunts released this 03 Aug 23:40
v1.0
ce71b86

First public release.

pwagen builds each web app you add into its own signed, installable APK. Android
gives every installed package exactly one UID, so each site ends up with its own
identity to any per-app firewall, its own kernel-enforced data sandbox, its own
runtime permissions, and its own launcher entry — with nothing to configure in
pwagen itself.

Notable properties

  • The generator has no INTERNET permission at all. Icons and names come
    from local input only; there is no web-app-manifest fetching. This is an
    auditable property of the manifest, not a promise.
  • The signing key used for generated apps is hardware-backed (AndroidKeyStore,
    EC P-256, StrongBox where available) and non-exportable. It survives app
    updates and is destroyed on uninstall.
  • Backups contain config and icon bytes, never the key.
  • Generated apps use hardened WebView defaults; permissions you do not opt into
    are stripped from the generated manifest entirely rather than gated in code.

Requirements

Android 11 (API 30) or newer. Targets Android 16 (API 36). Developed against
GrapheneOS, where Vanadium is the system WebView; degrades gracefully on stock AOSP.

Verifying this build

sha256  8ed7848b8a80e40f33fc9cd6bd5564fa31c0d7bd4628a470ca66178c968ecc12

Signing certificate SHA-256 (all future releases will use this same key):

813d6225f1c3bedeafd47e33775e7c0f5390cdedf259bd883c0e26b6d04b9dee

Check it yourself with apksigner verify --print-certs pwagen-1.0.apk.

Assets 3
Loading