Your passwords in a box. And the box stays with you.

KutunaCo is an offline, account-free password manager and subscription tracker for iOS and Android. It keeps passwords, credit cards, API keys and secure notes encrypted with AES-256 on the phone only, generates 2FA codes, checks password health and adds up your subscriptions monthly and yearly.

Correct. The app makes no network requests; the Android build doesn’t even hold the internet permission. There is no account, server, sync or analytics. Two exceptions lie outside the app, both on Android: Google Play services, which provides the QR code reader, may send Google anonymous diagnostics about the reader; and to show you when a new version is out, KutunaCo asks the Play Store app on your phone whether there’s an update, and the Play Store may send Google device and app details such as the phone model and the app’s version. Your items and the QR code’s content are never part of either.

No. Install the app and choose your lock; that’s it.

Your box and settings are encrypted with AES-256; the key is kept in the iOS Keychain or Android Keystore, on that device only. Backups are encrypted with AES-256-GCM under a key derived from your password with Argon2id (64 MiB of memory, 3 iterations).

Yes. TOTP codes are generated entirely on the device from the setup key you add (by scanning the service’s QR code or pasting the key) and the phone’s clock; no connection is needed. All codes are on the 2FA Codes screen.

Yes. Tap + › Scan 2FA QR Code and point the camera at the QR code a service shows, or choose a screenshot. The image is read on the device only; on Android the reader comes with Google Play services, which may send Google anonymous diagnostics about its use (never the image or the code’s content), and the app still has no internet permission.

On Android, app data is excluded from device and cloud backups. On iOS your box’s encrypted file may be included in a device backup, but the key that opens it stays on that device, so it cannot be opened elsewhere. Use an encrypted KutunaCo backup to change phones.

You choose KutunaCo as the autofill service on Android or as a password provider on iOS. Every fill asks you to authenticate, and suggestions only appear in the verified app or on the matching domain.

Your box is tied to the device; it does not move with an iCloud or Google backup. Make a password-protected backup on the old phone (Settings › Data Management › Back Up) and import it on the new one.

Tap “Forgot your PIN?” on the lock screen, verify with your device’s screen lock or biometrics and set a new PIN. This works while “Allow PIN Reset with Device Lock” is on (the default). Otherwise the only way is to delete all data and restore from a backup.

Backups are encrypted with AES-256-GCM using a key derived with Argon2id (64 MiB of memory, 3 iterations); weak and common passwords are rejected. If you forget the password, no one can open it.

Yes. Exports from Chrome/Edge, Apple Passwords, Firefox, Bitwarden, 1Password, KeePass, Proton Pass, LastPass, Enpass and generic CSV are supported, plus 2FA transfers from Aegis, 2FAS, Ente Auth and Google Authenticator (its transfer QR codes can be scanned in the app).

English, Turkish, German, Spanish, Italian, Portuguese, Japanese, Korean and Hindi. By default the app follows your device: it uses the first language in your device’s list that the app has, and English if it has none of them. You can change it in Settings › General › Language.

Yes, KutunaCo is a one-time purchase. There are no in-app purchases, subscriptions or ads.

The purchase goes through the App Store or Google Play, so refunds follow their rules: Apple through reportaproblem.apple.com, Google Play within 48 hours of buying. The support page has the steps.

Yes. The same app runs on iPhone and iPad (iOS 15 or later) and on Android phones and tablets (Android 7.0 or later). Each device keeps its own box; move items between them with an encrypted backup.

No. KutunaCo sends no notifications. The Subscriptions filter shows what renews next and when, and the monthly and yearly totals.

On iOS 26.2 and later, yes: you can choose to save it to KutunaCo, and the save waits for your approval in the app. On Android, no: add new passwords in the app.

Settings › Danger Zone › Delete All Data. Deleting the app also removes your box; on iOS use Delete All Data first, because keychain items stay after the app is deleted. Nothing is stored on a server.

Add a fee, currency and billing cycle (weekly, monthly, quarterly, yearly) to any item, or add a subscription on its own; the “Subscriptions” filter on the home screen shows monthly and yearly totals and what renews next.

No. KutunaCo never goes online, so it cannot query an outside breach list such as Have I Been Pwned. Instead it offers a password health report that finds weak, reused, old and 2FA-less passwords entirely on the device.

No. KutunaCo stores usernames and passwords, 2FA codes, cards, API keys and secure notes; passkeys are not supported.