KutunaCo security model

Last updated:

On this page

KutunaCo is an offline, account-free password manager for iOS and Android. This page explains what KutunaCo 1.12.0 protects, where your data is kept and what it defends against, and it says plainly what it cannot do.

In short

  • Your box and settings are encrypted on the phone with AES-256; the key is kept in the iOS Keychain or Android Keystore, on that device only.
  • There is no account, server, sync, advertising or analytics. The Android build does not even hold the internet permission; the app cannot make a network request.
  • Backups are encrypted with AES-256-GCM under a key derived from your password with Argon2id (64 MiB of memory for new backups).
  • The app lock opens with biometrics, the device passcode or a 4–8 digit app PIN.

Why offline?

Cloud password managers keep millions of vaults on the same servers, and those servers are one large target. With KutunaCo there is no central database to leak, no server to attack and no account to take over. Your box exists only on your phone and in the backups you make.

The trade-off is just as clear: there is no automatic sync between devices. To move to another phone you make an encrypted backup and import it on the new one.

Where your data lives

  • Box items and settings: in the app's own folder, encrypted with AES-256 under a randomly generated 256-bit key.
  • Box key: on iOS in the Keychain with "this device only" protection (never sent to iCloud, never restored to another device); on Android wrapped by the Keystore.
  • App PIN: the PIN itself is never stored, only a salted PBKDF2-HMAC-SHA256 hash (210,000 iterations). From the fifth wrong attempt, an increasing wait from 30 seconds up to one hour applies.
  • Autofill copy: only password items that are not in the trash are handed over. 2FA secrets, notes, card and API key data are never written to the autofill store.
  • Backups: saved only where you choose; temporary files are deleted after sharing.
  • 2FA QR scanning: camera frames are never stored; the temporary copy of a screenshot you pick is deleted after it is read, and the codes scanned from a Google Authenticator transfer stay in memory until you import them.

Lock and authentication

  • The lock opens with biometrics (Face ID, fingerprint), the device passcode or the app PIN. On Android it accepts only strong (Class 3) biometrics or the device passcode.
  • With a PIN-only lock, turning on Biometric Unlock asks for the PIN first.
  • Auto-lock options: immediately, 30 seconds, 1 minute, 5 minutes, 15 minutes or never. The timer is measured so that turning the device clock back cannot bypass it.
  • Sensitive actions such as exporting, deleting all data, turning the lock off and changing the PIN ask you to authenticate again.
  • If you forget your PIN, verify with the device's screen lock or biometrics and set a new one. This works while Allow PIN Reset with Device Lock is on (the default). Turn it off so that someone who knows your device passcode cannot set a new PIN; a forgotten PIN then means deleting all data and restoring a backup, as it does on a device with no screen lock.

Autofill

  • Android: an item is suggested only when the requesting app's package name and signing certificate match the linked app, or when the domain matches in a known browser whose signature is verified. Every fill asks you to authenticate, and with a PIN-only lock it asks for the app PIN too. Only the password being filled is decrypted. Without a secure screen lock, autofill does not work.
  • iOS: nothing is listed without device-owner authentication (Face ID, Touch ID or the passcode). The system is told only the domain and username, never the password.
  • 2FA links: an otpauth:// link opened by a website or another app is shown with a warning and saved only after you confirm; an existing 2FA key is never replaced.

Clipboard and screen

  • Copied passwords are flagged as sensitive: on Android 13 and later they don't appear in previews or the keyboard's clipboard history, and on iOS they don't travel to your other devices through Universal Clipboard.
  • The clipboard is cleared after the time you choose (30, 60 or 90 seconds, or never) and when the app locks. Copied 2FA codes are flagged as sensitive too.
  • On Android, screenshots and screen recording are blocked. On iOS the content is hidden while the app is in the background and during screen recording.
  • Keyboard learning and autocorrect are off in sensitive fields.

Backups

  • The key is derived from your backup password with Argon2id (64 MiB of memory, 3 iterations, 4 lanes: RFC 9106's recommended setting); every file names its own parameters, so backups made before 1.8.0 with 19 MiB / 2 iterations keep opening; the content is encrypted with AES-256-GCM and the header is authenticated too, so a tampered file will not open.
  • The backup password must be at least 10 characters. Guessable passwords such as "Password123!" are rejected, and so is the product name KutunaCo.
  • If you forget the password, nobody can open the backup, including us.
  • An unencrypted export happens only if you explicitly confirm it, and anyone who opens that file can read your items.

Known limitations

  • The app lock is a UI lock. The box key is not bound to biometrics; the box is encrypted with a key that is available after the device's first unlock.
  • Biometric unlock also accepts the device passcode; someone who knows your passcode can open your box.
  • Your box does not move to a new phone with an iCloud or Google device backup. Make an encrypted KutunaCo backup before changing or resetting your phone.
  • There is no breach check (such as Have I Been Pwned); the app never goes online, so it cannot query an outside list. The password health report is computed entirely on the device.
  • Passkeys are not supported.
  • The iOS AutoFill extension does not ask for the app PIN; it asks only for device-owner authentication. That is why, with a PIN-only lock and PIN reset turned off, no passwords are given to iOS AutoFill and autofill is unavailable there.
  • Before you verify, autofill suggestions show the item title and username (iOS QuickType; Android locked suggestions). On Android, Settings › Security › Hide Usernames in Suggestions hides the username.
  • The QR code reader on Android comes with Google Play services, and it also reads the screenshots you choose; without Google Play services, type or paste the setup key. Google Play services may send Google anonymous diagnostics about each use of the reader (the kind of event, how long it took, an error code, and device and app details such as the phone model and the app's version); the image, the QR code's content and the items in your box are never part of them.
  • To show you when a new version is available, the Android app asks the Play Store app on your phone whether there is an update (Google Play In-App Updates) each time it starts and, when you return to it, at most once an hour. To answer, the Play Store may send Google device and app details such as the phone model and the app's version; the items in your box are never part of them, and the app itself still makes no network requests. On iPhone the app checks nothing: Settings › About opens KutunaCo's page in the App Store.
  • No app can fully protect data on a rooted, jailbroken or malware-infected device.

Reporting a vulnerability

If you find a security issue, please write to support@kutuna.co. Include the affected version, the platform and the steps to reproduce it; never send real passwords or other data from your box. The contact details are also listed in security.txt.