DualKey

DualKey keeps three things in one app: the two-factor codes you sign in with, the passwords you look up every day, and the notes you'd rather nobody glanced at.

■ Codes
• Add accounts by scanning a QR code, picking an image from your photos, pasting an otpauth link, or typing the secret key yourself
• Time-based (TOTP) and counter-based (HOTP) codes, with a dial showing the seconds left
• Tap to copy; copied codes can be cleared from the clipboard automatically
• Import a backup exported from 2FAS; moving from Authy? The app walks you through three ways to do it
• Health check: spots duplicate secret keys, accounts with missing details, and accounts not yet in your backup
• No limit on accounts; from the 5th one, a short ad plays before adding
• Codes are worked out on your phone, so they work with no connection

■ Passwords
Locked with your master password — a good home for social accounts, Wi-Fi and door codes.
• Built-in password generator
• Import CSV files exported from Chrome, Safari or Bitwarden in one go
• See which passwords haven't been changed in a while
• Unlock with your face or fingerprint; locks itself when you leave the app for a while
For online banking or crypto wallets, a dedicated password manager is a better fit.

■ Notes
Private notes locked with the same master password.
Passwords and notes are completely free, with no limit.

Want a little more protection? Premium is a one-time purchase, no subscription:
• No ads at all
• Google Drive sync, encrypted with your backup password before upload
• App lock: face or fingerprint check before the app opens
• Export an encrypted backup file and restore it on a new phone
• Move accounts to another authenticator with a QR code
• The health check lists exactly which accounts need attention and how to fix them

Your data
No sign-up, no email, no phone number. Secret keys stay in your phone's secure storage; passwords, account notes and the text of your notes are encrypted with your master password before they're saved (titles, usernames and URLs are stored as plain text). Cloud sync is off by default. Turn it on and a copy goes only to your own Google Drive, already encrypted; we have no servers and can't see anything. Ads are non-personalized, and the app never asks to track you.