{"package_name":"app.keyholm","name":"Keyholm","summary":"Single-device passkeys on secure hardware","category":"Password & 2FA","icon_url":"/api/icon/app.keyholm","latest_version_code":4,"latest_version_name":"0.0.4","apk_url":"/api/apk/app.keyholm","apk_size":5226391,"apk_sha256":"34376ab1a083054b3f613894a000fdf5ba61f13c1710db4f5437e155aa3f165c","source_kind":"fdroid-repo","repo_slug":"fdroid-main","last_updated":1792119618,"release_timestamp":1792083575,"description":"<p>Keyholm is all about single-device passkeys (i.e. client-side discoverable credentials) whose private key is protected by secure hardware.</p>\n\n<p>You can never export or sync these passkeys. Think of Keyholm as a way to activate the built-in security key on your phone.</p>\n\n<ul>\n<li>target devices: phones with secure hardware (including Pixels)</li>\n<li>no INTERNET permission</li>\n<li>no Google Play Services ever</li>\n<li>takes advantage of latest Android version/APIs</li>\n<li>allows extensive control over particulars of what credentials it creates and how\n<ul>\n<li>supports ES256: it's the only EC, StrongBox-backed algorithm</li>\n<li>supports Ed25519: it's not NIST, it's fast and safe but TEE-only</li>\n<li>supports ML-DSA: post-quantum! but Android 17 and TEE-only</li>\n</ul>\n</li>\n<li>supports android-key attestation</li>\n<li>supports PRF extension</li>\n<li>uses QUERY_ALL_PACKAGES in order to display icons for apps that were denied passkey usage</li>\n<li>account list export/import for making it marginally easier to switch devices. All keys still need to be manually recreated on the new device!</li>\n</ul>\n","categories":["Password & 2FA","Security"]}