CipherAuth is a secure, offline-first, cross-platform password manager application designed for simplicity, security, and privacy. Built with Flutter, it provides an encrypted vault to store both your 2FA authentication tokens and passwords across Android and Windows.
Checkout the app website for details: CipherAuth Website
Important
License Model: CipherAuth is source-available software (not open-source). See the LICENSE file for usage and redistribution terms.
Privacy Policy: See the full policy in the local GIST.md file or on GitHub Gist.
- Use the following buttons to get the app for your device through the official channels:
- Alternatively, for Windows devices, you can run the following command for a seamless install.
winget install cipherauth
# Or explicitly with app id:
winget install --id 9NS2R9NTRF2Z --source msstoreYou can also download standalone installation binaries directly from the Releases Page.
- Dual Vault (TOTP & Password Manager): Manage 2FA authenticator tokens and passwords under dedicated tabs.
- Offline-First Privacy: Fully sandboxed offline execution. No user accounts, registration, analytics SDKs, or cloud backends.
- AES-GCM Encryption: Vault databases are encrypted using AES-GCM with keys derived from your Master Password via SHA-256.
- Autofill: Securely enter your login details on apps and websites without the effort of copy-pasting your credentials.
- Secure Local Sync: Bidirectional local network sync (LAN) using a secure custom handshake protocol. Data is kept encrypted end-to-end and only decrypted if both devices have matching master passwords.
- Biometric Authentication: Support for Android Biometrics and Windows Hello (Fingerprint, Face unlock, or PIN code verification).
- Encrypted
csv: To safeguard from accidental uninstalls, all your data can be exported to a csv file,encrypted with your password. - Auto-Lock Security: Wipes the master password from runtime memory (
RuntimeKey) and locks the application interface when paused or backgrounded (Android only). - Passphrase Generator: Create strong, human-readable passphrases (e.g.,
correct-bell-pepper-salt) using a built-in customizable wordlist generator. - Screenshot Protection: Automatic screenshot blocking and background task-switcher cover/masking on Android devices.
- Recycle Bin: Safeguards deleted records, retaining them for 30 days before purging. Supports instant permanent deletion.
- QR Code Scanning & Import: Setup accounts by scanning QR codes with your device camera, importing an image from the gallery, or opening
otpauth://deep-links.
CipherAuth is built with Flutter and can be compiled for any platform (iOS, Android, macOS, Linux, Windows) with minimal code changes.
Note: Source visibility is provided for transparency and learning. Reuse, redistribution, and derivative standalone releases require prior written permission.
-
Clone the repository.
-
Ensure you have Flutter installed. If not, follow the Flutter installation guide.
-
Install dependencies:
flutter pub get
-
Run the application:
flutter run
Use these commands to run the correct Android variant:
# Production flavor
flutter run --flavor prod
# Sample/Test flavor
flutter run --flavor sampleflutter build apkThe compiled APK will be available in the build/app/outputs/apk/ folder.
To build a specific flavor:
# Production flavor
flutter build apk --flavor prod
# Sample/Test flavor
flutter build apk --flavor sampleFlavor APK outputs are generated under build/app/outputs/flutter-apk/.
flutter build windowsThe compiled Windows executable will be available in the build/windows/x64/runner/Release/ folder.
To build an MSIX package:
dart run msix:createThe generated MSIX package will be available in the build/windows/x64/runner/Release/ folder.
For detailed windows release instructions, see the Flutter documentation.
How secure is CipherAuth?
CipherAuth uses military-grade AESGCM encryption to protect your credentials and maintain integrity. Every bit of information is stored as ciphertext in the device storage and the OS KeyStore, and only decrypted in runtime memory.
What is MFA or 2FA?
Multi or 2 Factor Authentication adds a second layer to the safety of your accounts, asking for a configured service and a login success with password. This ensures that it is the rightful owner accessing his account. Traditionally SMS and Email OTPs are used, but they pose an eavesropping risk. TOTP based authenticators remove this factor as the code is refreshed twice a minute, and is always locally available in your device.
What are passphrases?
Passphrases are sequences of random words (e.g., "correct-bell-pepper-salt") instead of traditional passwords. Because of their length, they are highly secure and extremely difficult for computers to brute-force, yet much easier to remember and type.
What is autofill?
Copying passwords and pasting them poses a risk, clipboard is an open book for all the apps to read and write to. To make you secure from password thefts, CipherAuth integrates with the operating system itself, which tells the app the url of the website, and CipherAuth securely fills the credentials directly in the input fields. For browsers, change their settings to allow 3rd party apps to autofill.
How does autofill work?
You are asked for a URL while creating a password. This plus the username is a unique identifier of the password. During autofill, the OS hands over the url of the browser to CipherAuth and the only the filtered credentials are returned.
What is Local Sync?
Since CipherAuth doesn't have a cloud server, syncing manually between every device is a pain, in sync, your devices should be on the same network and have the same password. Encrypted credentials from one device are sent over to the other, decrypted, processed, merged, and sent back again encrypted. Anyone sniffing the packets will only see a ciphertext.
Are devices with different versions compatible with other?
The core concept of the app is privacy and it is still ever since the app was made. However with newer versions, it gets better and convenient. It is advisable to keep your app updated. Although backward and forward compatibility is implemented wherever it could be, some features in sync and import could break since both apps have different versions. Please keep your backup csv files at all times.
Is exporting a csv file safe?
Yes, even the csv files are encrypted and can only be decrypted by the same password it was used to encrypt. Your digital identity is completely secure and truly in your hands. It is saved in your Downloads directory. However, still it is a better approach to safeguard this file.
How does the import work?
Importing a file works only if it has not been tampered with and you know the password which which it was encrypted. It scans the file data and current vault and prompts the user of new accounts that are found and ready to be added.
What if I forget my master password?
If you forget your master password, there is no way to recover your data. There are no "backdoors" or password recovery options for your security. Please ensure you keep your password in a safe place. It is highly advisable to turn on biometric protection as a backup to your master password for easier access while maintaining security.
Is permanent delete applied to all my devices?
No. CipherAuth has no central server to force-delete entries everywhere. Permanent delete only affects the current device. If another device still has the same credential (in the main list or its Recycle Bin), a later sync can add it back as a fresh entry. Even importing from an exported csv file can resurrect the deleted credentials.
What if someone gains access to my device?
All data stays encrypted locally using your master password or biometric protection; without that master password, the stored credentials are unreadable.
CipherAuth is source-available software (not open-source) protected under copyright:
- You are permitted to view, inspect, audit, and run this source code for personal or educational purposes.
- Redistribution, rebranding, republishing modified versions, or commercial packaging of standalone builds is strictly prohibited without prior written consent from the copyright owner.
See the LICENSE file for more information.
Code contributions and bug fixes are welcome! Please submit an Issue or pull request to discuss major modifications before implementation.