Vault security
Your vault is protected on every device, not just on our server.
Encrypted on the device
Your vault is stored encrypted with AES-256-GCM under a key derived from your master password with Argon2id. The unlocked key is held only in memory and cleared when the vault locks.
Locks itself
Choose how quickly Pearl Pass locks when you step away. Locking wipes the key from memory.
Fingerprint unlock
On Android, fingerprint unlock is handled by the phone. Pearl Pass only learns yes or no, and uses it to release a key kept in the phone's secure hardware. We never receive your fingerprint.
Careful with copies
Copied passwords and codes are marked sensitive so Android doesn't preview them, and the clipboard is cleared after 45 seconds.
- Screenshots and screen recording of the app are blocked
- The vault is excluded from Android cloud backup
Breach check without sending passwords
Optional and off by default. Pearl Pass hashes a password on your device and sends only the first five characters of the hash to the Have I Been Pwned range service, then compares the results on your device.