package icon

Keyholm

Single-device passkeys on secure hardware
New in version 0.0.5
This release has one big change:

- Keyholm now always encrypts its metadata at rest
- App data from previous versions is migrated

Otherwise UI & stability improvements and APK size optimizations.
Keyholm is all about single-device passkeys (i.e. client-side discoverable credentials) whose private key is protected by secure hardware.

You can never export or sync these passkeys. Think of Keyholm as a way to activate the built-in security key on your phone.


  • target devices: phones with secure hardware (including Pixels)

  • no INTERNET permission

  • no Google Play Services ever

  • takes advantage of latest Android version/APIs

  • allows extensive control over particulars of what credentials it creates and how

    • supports ES256: it's the only EC, StrongBox-backed algorithm

    • supports Ed25519: it's not NIST, it's fast and safe but TEE-only

    • supports ML-DSA: post-quantum! but Android 17 and TEE-only



  • supports android-key attestation

  • supports PRF extension

  • uses QUERY_ALL_PACKAGES in order to display icons for apps that were denied passkey usage

  • account list export/import for making it marginally easier to switch devices. All keys still need to be manually recreated on the new device!


  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot

Versions

Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.

Download F-Droid
  • Version 0.0.5 (5) suggested Added on Oct 27, 2026

    arm64-v8a armeabi-v7a x86 x86_64

    This version requires Android ? or newer.

    It is built and signed by the original developer, and guaranteed to correspond to this source tarball.

    Permissions
    • hide other apps overlays
      This app can request that the system hides overlays originating from apps from being shown on top of it.
    • query all packages
      Allows an app to see all installed packages.
    • use biometric hardware
      Allows the app to use biometric hardware for authentication
    • use fingerprint hardware
      Allows the app to use fingerprint hardware for authentication

    Download APK 4.3 MiB PGP Signature | Build Log

    • New in version 0.0.4
    Keyholm's first release on fdroid! It's quite feature complete already when it comes to single-device passkeys:

    - Passkey creation/use as an Android passkey service
    - Passkey management
    - Extensive settings for configuring exactly how to create/use your passkeys
    - PRF support
    - Passkey list export/import
    - Icon pack support
    - Editable RP name, username and display name
    - Non-discoverable passkeys

    This should be the same as v0.1, which will be the first release with backwards compatibility.
  • Version 0.0.4 (4) - Added on Oct 15, 2026

    arm64-v8a armeabi-v7a x86 x86_64

    This version requires Android ? or newer.

    It is built and signed by the original developer, and guaranteed to correspond to this source tarball.

    Permissions
    • hide other apps overlays
      This app can request that the system hides overlays originating from apps from being shown on top of it.
    • query all packages
      Allows an app to see all installed packages.
    • use biometric hardware
      Allows the app to use biometric hardware for authentication
    • use fingerprint hardware
      Allows the app to use fingerprint hardware for authentication
    • app.keyholm.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

    Download APK 5.0 MiB PGP Signature | Build Log

Find Apps