MyPwdTool

MyPwdTool is a password manager built around one simple idea: your data should never be readable by anyone but you — not MyPwdTool, not a cloud provider, not anyone.

NO ACCOUNT
The vault, autofill, password health checks, breach checks, TOTP two-factor codes, passkey metadata storage, and encrypted backups all work fully offline and available without In App Purchases — no feature limits, no time limit, no account or sign-up of any kind, on any platform.

MULTI-DEVICE SYNC, OPTIONAL
The only feature that requires a subscription is multi-device synchronization, an affordable yearly subscription that lets your passwords stay in sync across all your devices — Android, iPhone/iPad, Mac, and PC — without a central cloud database.
Devices talk directly to each other through a relay server whose only job is to pass encrypted messages along; it has no concept of a "vault," a "password," or a "user account," and could never read your data even if it were compromised. Joining a sync group someone else already created doesn't require a subscription — only creating a new group or inviting further devices does.

SECURITY, DONE PROPERLY
Every sensitive field — password, username, note, card number, TOTP secret — is independently encrypted with AES-256-GCM. Your master password is used once, locally, to derive a key via PBKDF2-HMAC-SHA256 with 400,000 iterations; it is never stored and never leaves your device. If you forget it, nobody — including us — can recover your vault. Unlock with your fingerprint or face between master-password prompts, on your own schedule.

WHAT'S INSIDE
• Encrypted vault for passwords, passkeys metadata, TOTP codes, and payment cards
• Multiple independent vaults (e.g. personal + work)
• Android's own Autofill Service integration — fills your passwords in any app or browser, not just one
• Password health audit: weak, reused, and old passwords flagged on-device
• Breach check against Have I Been Pwned, using k-anonymity so your password never leaves your device
• Encrypted local backups and CSV import/export
• A full local activity log

NO TRACKING, EVER
No analytics, no advertising, no third-party SDKs for tracking, no account system, no server-side storage of your vault or its contents. The relay's source code is public for independent review.