Your passwords, on your phone.
An encrypted vault in the Android app. Filled by Android Autofill. Never synced.
How the vault is protected.
Standard, well-studied building blocks, described exactly.
Your master password…
Only you know it.
…becomes a key
PBKDF2-SHA256, run 600,000 times, so every guess is slow.
…that seals the vault
AES-256-GCM. Tampered data is rejected, not opened.
The encrypted vault stays on the phone. It isn't uploaded, synced or backed up to any AshtaLok server.
A way back is coming.
Soon a code we send you, then your fingerprint or a Recovery Code you save at setup, will let you choose a new master password and keep your passwords. We'll still never hold your master password or the key to your vault. Until then, choose one you'll remember.
What it does, and doesn't.
Does
- Keeps logins in an encrypted vault on your phone.
- Unlocks with your master password.
- Fills logins in apps and browsers through Android Autofill.
Doesn't
- No cloud sync: one phone, one copy.
- No back door: nobody else can open your vault.
- No computer version.
- Apps without Android Autofill support.
Strong, not magic.
A strong master password matters most
Long, and not used anywhere else.
Your phone's safety is the vault's
Nothing protects logins on a compromised phone.
One phone, one copy
Lose the phone, and you lose the vault too.
Straight answers.
Can AshtaLok see my passwords?
No. The vault is encrypted on your phone with a key made from your master password, and it isn't sent to AshtaLok.
Can I use it on my computer?
No. The vault lives only on your phone and nothing is synced.
What happens if I lose my phone?
The vault on it stays encrypted, and opening it needs your master password, or your phone's biometrics or screen lock if you turned on quick unlock. Because nothing is synced, you lose access to it too.
Is it available now?
Not yet. It's part of the Android app, which is in final testing.