Keyholm

app.keyholm
by Zapstore _@zapstore.dev

Single-device passkeys on secure hardware

Republished from GitHub / F-Droid by the Zapstore main account.

Keyholm is all about single-device passkeys (i.e. client-side discoverable credentials) whose private key is protected by secure hardware. You can never export or sync these passkeys. Think of Keyholm as a way to activate the built-in security key on your phone. - target devices: phones with secure hardware (including Pixels) - no INTERNET permission - no Google Play Services ever - takes advantage of latest Android version/APIs - allows extensive control over particulars of what credentials it creates and how - supports ES256: it's the only EC, StrongBox-backed algorithm - supports Ed25519: it's not NIST, it's fast and safe but TEE-only - supports ML-DSA: post-quantum! but Android 17 and TEE-only - supports android-key attestation - supports PRF extension - uses QUERY_ALL_PACKAGES in order to display icons for apps that were denied passkey usage - account list export/import for making it marginally easier to switch devices. All keys still need to be manually recreated on the new device!

First release: Oct 27, 2026, 1 total release.

Most recent release: Oct 27, 2026.

Repo

Appears in 0 app stacks.

0 sats / 0 zaps received in the past year.

Sats Received

Underlying data available via MCP: app_zaps, app_releases.

Zap Count

Underlying data available via MCP: app_zaps, app_releases.

Releases

  • Oct 27, 2026 0.1.0
    ## What's Changed Keyholm now guarantees app data backwards compatibility, starting with this version's. WARNING: If you're upgrading from v0.0.4 or below and don't want to lose your data, you must upgrade to v0.0.5 first to migrate! Keyholm only supports encrypted at rest data from now on. Otherwise there are just small UX improvements in this release.
    More…
    **Full Changelog**: https://github.com/keyholm/keyholm/compare/v0.0.5...v0.1.0 ## Artifacts | | | |-|-| | `keyholm.apk` | the release APK, signed with the release key | | `keyholm-unsigned.apk` | the reproducible build output, before signing | | `keyholm-unsigned.apk.sigstore.json` | keyless Sigstore bundles proving the APK was produced by this workflow | | `keyholm.apk.sigstore.json` | keyless Sigstore bundles proving the APK was verified by this workflow | The signed APK's ZIP payload is byte-identical to `keyholm-unsigned.apk`. Only the APK Signing Block differs. See the workflow run for the recorded SHA-256 of each. ## Verify provenance Install [cosign](https://docs.sigstore.dev/cosign/installation/): ```bash SHA=54303ca266a4d8ea2187da90d2632536fe33edc5 # Or if you have a local clone # SHA=$(git rev-parse "v0.1.0^{commit}") gh release download v0.1.0 cosign verify-blob \ --bundle keyholm.apk.sigstore.json \ --certificate-identity-regexp '^https://github\.com/keyholm/keyholm/\.github/workflows/release\.yml@' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-sha $SHA \ keyholm.apk cosign verify-blob \ --bundle keyholm-unsigned.apk.sigstore.json \ --certificate-identity-regexp '^https://github\.com/keyholm/keyholm/\.github/workflows/release\.yml@' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-sha $SHA \ keyholm-unsigned.apk ``` Both APKs also have [build provenance attestations](https://github.com/keyholm/keyholm/attestations): ```bash gh attestation verify keyholm.apk \ --repo keyholm/keyholm \ --signer-workflow keyholm/keyholm/.github/workflows/release.yml \ --source-digest $SHA gh attestation verify keyholm-unsigned.apk \ --repo keyholm/keyholm \ --signer-workflow keyholm/keyholm/.github/workflows/release.yml \ --source-digest $SHA ``` ## Verify the APK signature ```bash apksigner verify --print-certs -v keyholm.apk ``` ## Verify reproducibility ```bash git checkout v0.1.0 mise install mise exec -- gradle assembleRelease sha256sum keyholm-unsigned.apk app/build/outputs/apk/release/keyholm-unsigned.apk ```