KeyNest

Product Positioning

KeyNest is a Flutter-based local encrypted vault for personal password and 2FA management. It keeps password entries, TOTP secrets, and encrypted backups on the user’s own device, which fits users who prefer local storage and manual backup.

The project targets both iOS and Android. Its current focus is local unlock, entry management, 2FA management, encrypted backup, and temporary transfer between personal devices.

Password Management

• Set a master password on first launch.
• Unlock the local vault with the master password.
• Add, edit, delete, and search password entries.
• Store entries by categories such as website, app, email, card, profile, server, database, Wi-Fi, license, and 2FA.
• Save optional phone, address, and website URL fields.
• Group multiple accounts by website or by shared email.
• Generate random passwords and passphrases.

2FA Capabilities

KeyNest supports importing otpauth://totp/... links and scanning standard TOTP QR codes from Google Authenticator and similar apps. Entry cards can show live verification codes, remaining time, and 2FA metadata.

It also supports short-lived QR transfer for usernames, passwords, or the current 2FA code, which is useful when a value needs to be entered on a computer or another device.

Security Design

• The master password is not persisted in plain text.
• PBKDF2-HMAC-SHA256 derives a 256-bit key.
• Entry data is encrypted with AES-GCM before being written to secure storage.
• The in-memory session key is cleared after the vault is locked.
• The app locks automatically when it moves to the background.
• Android uses FLAG_SECURE to reduce screenshot and recent-task leakage.
• Clipboard values are scheduled for cleanup after copy.
• Fingerprint unlock is a session shortcut, not a replacement for the first master password unlock.

Backup and Restore

KeyNest can export local encrypted backups. On Android, backups are saved under Downloads/KeyNest/ by default. On iOS, backups are saved in the app documents directory and can be accessed through system file tools.

Restore can be done from a computer browser on the same local network. The upload endpoint is opened temporarily during restore and stops after the restore completes or the page is closed.

Current Limits

System autofill and cloud sync are not connected yet. KeyNest is better suited for local vault use, manual backup, and temporary transfer between personal devices.

Release Status

KeyNest is planned for release on Google Play. The Google Play installation and browser link will be added here after the app is published.

The public privacy policy is available at KeyNest Privacy Policy.