Galaxit PWM

Galaxit PWM is the native Android client for the Galaxit password manager of the same name (pw.galaxit.ch). Designed for Swiss SMEs and security-conscious private users, the app is based on a strict zero-knowledge model: Your private PGP key never leaves your device; the server only sees the encrypted data. WHAT THE APP CAN DO • Locally decrypted vault — all logins, notes, time-based one-time passwords (TOTP), and passkeys are stored PGP-armored on the server and can only be read with the passphrase on your device. • System autofill service — Galaxit PWM integrates with Android autofill and suggests logins directly in other apps and browsers (Settings → Passwords, Passkeys & Accounts → Autofill service). • Passkey Provider (Android 14+) — The app registers as a CredentialProvider; FIDO2 authentication uses a locally stored ECDSA P-256 key, signed per request via biometrics. WebAuthn compliant with byte-accurate compatibility with Apple Passkeys and Galaxit Web Vault. • Multi-Account — Any number of pwpw accounts can be used simultaneously, each with its own PGP key, biometric profile, and tenant. A star PIN is set for the default account upon app launch. • Multi-QR Pairing — Setup via browser: pw.galaxit.ch displays an animated QR sequence, which the app scans. The private key is transmitted exclusively by the camera; the server only knows the SHA-512 hash. • TOTP Generator — RFC-6238 with Base32 secret, 6 digits, 30-second rotation. Built-in QR scanner for otpauth: codes. • Cross-Device Approval — When you initiate a login on the desktop, the confirmation request appears as a push notification on the phone; Approval only with biometrics (BIOMETRIC_STRONG). • Encrypted Local Storage — Private key and passphrase are stored in EncryptedSharedPreferences (hardware-backed AndroidKeyStore MasterKey). Biometric compatibility mode for OEM stacks whose KeyStore does not stably support biometrically bound AES keys. SECURITY Galaxit PWM is open-source and follows the Passbolt security model. The server never has access to private keys, passphrases, or plaintext secrets. TLS + certificate pinning in the release build, FLAG_SECURE to prevent screenshot leaks in the vault, automatic screen lock after 5 minutes of inactivity. CONTACT support@pw.galaxit.ch · Galaxit ICT GmbH, Switzerland