KutunaCo security model

Last updated:

KutunaCo is an offline, account-free password vault for iOS and Android. This page explains what KutunaCo 1.6.5 protects, where your data is kept and what it defends against, and it says plainly what it cannot do.

In short

  • The vault and settings are encrypted on the phone with AES-256; the key is kept in the iOS Keychain or Android Keystore, on that device only.
  • There is no account, server, sync, advertising or analytics. The Android build does not even hold the internet permission; the app cannot make a network request.
  • Backups use the BBX2 format: encrypted with AES-256-GCM under a key derived from your password with Argon2id.
  • The app lock opens with biometrics, the device passcode or a 4–8 digit app PIN.

Why offline?

Cloud password managers keep millions of vaults on the same servers, and those servers are one large target. With KutunaCo there is no central vault to leak, no server to attack and no account to take over. Your vault exists only on your phone and in the backups you make.

The trade-off is just as clear: there is no automatic sync between devices. To move to another phone you make an encrypted backup and import it on the new one.

Where your data lives

  • Vault items and settings: in the app's own folder, encrypted with AES-256 under a randomly generated 256-bit key.
  • Vault key: on iOS in the Keychain with "this device only" protection (never sent to iCloud, never restored to another device); on Android wrapped by the Keystore.
  • App PIN: the PIN itself is never stored, only a salted PBKDF2-HMAC-SHA256 hash (210,000 iterations). From the fifth wrong attempt, an increasing wait from 30 seconds up to one hour applies.
  • Autofill copy: only password items that are not in the trash are handed over. 2FA secrets, notes, card and API key data are never written to the autofill store.
  • Backups: saved only where you choose; temporary files are deleted after sharing.

Lock and authentication

  • The lock opens with biometrics (Face ID, fingerprint), the device passcode or the app PIN.
  • Auto-lock options: immediately, 30 seconds, 1 minute, 5 minutes, 15 minutes or never. The timer is measured so that turning the device clock back cannot bypass it.
  • Sensitive actions such as exporting, deleting all data, turning the lock off and changing the PIN ask you to authenticate again.
  • If you forget your PIN, verify with the device's screen lock or biometrics and set a new one. If the device has no screen lock there is no way around the PIN; the only option is to delete the data and restore a backup.

Autofill

  • Android: an item is suggested only when the requesting app's package name and signing certificate match the linked app, or when the domain matches in a known browser whose signature is verified. Every fill asks you to authenticate. Without a secure screen lock, autofill does not work.
  • iOS: nothing is listed without device-owner authentication (Face ID, Touch ID or the passcode). The system is told only the domain and username, never the password.

Clipboard and screen

  • Copied passwords are flagged as sensitive: on Android 13 and later they don't appear in previews or the keyboard's clipboard history, and on iOS they don't travel to your other devices through Universal Clipboard.
  • The clipboard is cleared after the time you choose (30, 60 or 90 seconds) and when the app locks.
  • On Android, screenshots and screen recording are blocked. On iOS the content is hidden while the app is in the background and during screen recording.
  • Keyboard learning and autocorrect are off in sensitive fields.

Backups (BBX2)

  • The key is derived from your backup password with Argon2id (19 MiB of memory, 2 iterations); the content is encrypted with AES-256-GCM and the header is authenticated too, so a tampered file will not open.
  • The backup password must be at least 10 characters. Guessable passwords such as "Password123!" are rejected.
  • If you forget the password, nobody can open the backup, including us.
  • An unencrypted export happens only if you explicitly confirm it, and anyone who opens that file can read your items.

Known limitations

  • The app lock is a UI lock. The vault key is not bound to biometrics; the vault is encrypted with a key that is available after the device's first unlock. Binding the key to device authentication is on the roadmap.
  • Biometric unlock also accepts the device passcode; someone who knows your passcode can open the vault.
  • The vault does not move to a new phone with an iCloud or Google device backup. Make a BBX2 backup before changing or resetting your phone.
  • There is no breach check (such as Have I Been Pwned); the app never goes online, so it cannot query an outside list. The password health report is computed entirely on the device.
  • Passkeys are not supported.
  • The iOS AutoFill extension does not ask for the app PIN; it asks only for device-owner authentication.
  • No app can fully protect data on a rooted, jailbroken or malware-infected device.

Reporting a vulnerability

If you find a security issue, please write to support@kiplix.com. Include the affected version, the platform and the steps to reproduce it; never send real vault data or passwords. The contact details are also listed in security.txt.