🔐 Abdal LockBox

🌐 Read in your language: 🇬🇧 English | 🇨🇳 中文 | 🇷🇺 Русский | 🇪🇸 Español | 🇯🇵 日本語 | 🇮🇷 فارسی | 🇸🇦 العربية | 🇹🇷 Türkçe | 🇩🇪 Deutsch | 🇮🇳 हिन्दी

Secure. Store. Autofill. — A privacy-first Android password manager by Abdal Security Group.

Abdal LockBox keeps your credentials encrypted on your device, fills logins through the official Android Autofill framework, and backs up your vault with the portable .ablbx encrypted format — without sending vault secrets to a cloud backend.

🎯 Why This App Was Created

Most people store passwords in browsers, notes apps, or cloud services they do not fully control. That creates a real risk: one breach, sync leak, or device extraction can expose an entire credential map.

Abdal LockBox was built to solve a practical problem:

🏠 Keep credentials on the device under a single Master Password — no remote vault sync by design
⚡ Fill logins quickly in apps and browsers via Android Autofill
📦 Back up and restore safely using the standardized encrypted .ablbx format
🔑 Recover access with a Recovery Key if the Master Password is forgotten
💣 Protect under duress with optional Self-Destruct that silently wipes local vault data

The goal is a lightweight, security-oriented password manager that respects privacy and follows modern Android engineering practices (Jetpack Compose, Room, DataStore, authenticated encryption).

✨ Features & Capabilities

🗄️ Vault & Credentials

Create and unlock a vault with a Master Password
Add, edit, and delete credentials: title, username, password, website URL, app package, extra notes
Built-in password generator with strength indicator
Custom card and text colors for visual organization
Hide passwords by default (Settings)
Search, filter (All / Apps / Websites / Recently Used), and sort in Vault
Credential detail view with copy and open URL
Recent items on the Home dashboard
Searchable in-app Help & Guide (Home → Learn More)

📲 Android Autofill

System AutofillService for apps and browsers
Per-credential Enable Autofill toggle
Autofill in apps / browsers, require Master Password before fill, show fill suggestions
Confirm-save flow when new logins are detected
Manual field mappings for apps without standard autofill hints

🛡️ Security & Session

Auto-lock after inactivity (Never, 1 / 5 / 15 / 30 minutes)
Change Master Password
Recovery Key generation and rotation
Screenshot & screen-recording protection (FLAG_SECURE) across screens, dialogs, and sheets
Self-Destruct Password — silent emergency wipe when entered on the unlock screen
android:allowBackup="false" — Android cloud backup disabled for app data

💾 Backup & Migration

Export Vault → encrypted .ablbx file (passphrase-protected)
Import Vault → restore on the same or a new device
Official format OID: 1.3.6.1.4.1.66033.1.2.2.1

🔒 Why Abdal LockBox Is Trustworthy & Secure

Abdal LockBox follows a local-first, offline-first security model:

Principle	How it is applied
🔐 No plaintext secrets on disk	Credentials and settings are encrypted before persistence
🧠 Layered keys	Master Password / Recovery Key derive KEKs; DEK encrypts vault data
✅ Authenticated encryption	AES-256-GCM with AAD bound to vault context
🧩 Separated lookup index	HMAC-SHA-256 domain/package hashes for autofill matching
🚫 No cloud vault sync	Vault workflow does not depend on a remote password server
🪟 Screen protection	Optional secure windows block screenshots and recordings
💣 Duress wipe	Self-Destruct erases vault data without revealing the wipe

Encryption & Cryptography

Abdal LockBox uses a layered key model. Passwords and metadata are never stored in plaintext on disk.

Key Hierarchy

flowchart TB
    MP[Master Password] -->|KDF| KEK[KEK — Key Encryption Key]
    RK[Recovery Key] -->|KDF| RKEK[Recovery KEK]
    KEK -->|AES-256-GCM wrap| DEK[DEK — Data Encryption Key]
    KEK -->|AES-256-GCM wrap| IK[Index Key]
    RKEK -->|AES-256-GCM wrap| DEK
    RKEK -->|AES-256-GCM wrap| IK
    DEK -->|AES-256-GCM| Items[Vault Items & Settings]
    IK -->|HMAC-SHA-256| Lookup[Domain / Package Lookup Hashes]

Material	Role
Master Password	Derives KEK via KDF; unlocks the vault
Recovery Key	Derives Recovery KEK; resets Master Password
KEK	Wraps DEK and Index Key
DEK	Encrypts credential blobs and settings
Index Key	Computes HMAC lookup hashes for autofill matching

Primary KDF: Argon2id (memory 32,768 KiB · iterations 3 · parallelism 2 · 32-byte output)
Fallback KDF: PBKDF2-HMAC-SHA256 (600,000 iterations)
AEAD: AES-256-GCM (32-byte key · 12-byte nonce · 128-bit tag) via Google Tink / JCE

For the full security architecture, see the Whitepaper.

🚀 How to Use

First Launch

Install Abdal LockBox.
Create a strong Master Password (minimum 6 characters; longer is strongly recommended).
Save your Recovery Key offline in a safe place when prompted.

Daily Use

Task	Where
➕ Add a password	Home or Vault → +
📚 Browse credentials	Vault tab
🔎 Search / filter	Vault search bar and chips
👁️ View / copy details	Eye icon on a credential card
📲 Enable Autofill	Autofill tab + set Abdal LockBox as the system autofill service
📤 Export backup	Settings → Export Vault
📥 Import backup	Settings → Import Vault
💣 Self-Destruct setup	Settings → Self-Destruct
📖 Help topics	Home → Learn More

Autofill Setup

Open Autofill and enable autofill in the app.
Go to Android Settings → Passwords & accounts → Autofill service (wording may vary by OEM).
Select Abdal LockBox.
Focus a login field in another app or browser and choose the suggested credential.

Backup Tips

💾 Export regularly and store .ablbx files in a secure location.
🔑 Use a strong export passphrase different from everyday passwords when possible.
🧾 Keep your Recovery Key separate from the backup file.

🧰 Technical Overview (For Developers)

Build toolchain

🐘 Gradle (wrapper): 9.3.1
🤖 Android Gradle Plugin (AGP): 9.1.1
🟣 Kotlin: 2.2.10
⚙️ KSP: 2.3.5
☕ Java compatibility (source/target): 11

Android SDK / API levels

🛠️ compileSdk: 36 (Android 16)
🎯 targetSdk: 36
📉 minSdk: 26 (Android 8.0)
📦 applicationId: com.abdal.lockbox · versionName: 1.65 (versionCode 165)

Platform APIs used

abdal-lockbox

Most Popular