1Key is a local-first password manager for Android. Your vault lives on your device, encrypted with a key only you hold, and never moves unless you export it yourself. There is no account to create, no server to breach, and no network connection of any kind — the INTERNET permission is stripped from the manifest, so the operating system itself enforces the offline guarantee. <b>Security</b> • Vault key derived from your master password with Argon2id (m=64 MiB, t=3, p=1 by default; configurable up to m=256 MiB, t=16) • Every credential field encrypted separately with AES-256-GCM, bound to its row and column via additional authenticated data — an attacker with raw database write access cannot swap ciphertexts between rows • Master-password verifier stored in EncryptedSharedPreferences, itself wrapped by an Android Keystore-bound key (TEE or StrongBox where available), so offline brute-force of a leaked device image is not possible • Optional 128-bit Secret Key mixed into the KDF for defense-in-depth against a compromised master password • Biometric unlock backed by hardware-secure key; requires master-password confirmation to enable • Tiered attempt limiting: 3, 5, and 10 wrong attempts trigger 30-second, 5-minute, and 1-hour cooldowns; counters survive process kills <b>Vault</b> • Store credentials with title, username, password, URL, notes, and custom fields • Tag-based organisation, favourites, full-text search • TOTP / 2FA codes stored in the same entry as the password they protect — no app switching • Live-preview Markdown in notes with a helper bar; disable in Settings if you prefer plain text • Soft-delete recycle bin (toggle off if you prefer immediate deletion) • Credential history preserves previous values on edit <b>Autofill</b> • System-level Autofill Service — fill logins into any app or browser without leaving them • URL-only matching by default (no fuzzy suggestions) to keep phishing risk down • Save prompt on submit; per-action confirmation for c