This is a small independent app maintained by one person, so please allow a few days for a reply. Bug reports and feature requests are better raised on the public issue tracker, where they are visible and can be tracked.
Never send us a password, your master password, a security-question answer, your vault file, or a CSV export. We do not need them, we cannot use them, and email is not a safe place for them. If a support request seems to require one, it doesn't — tell us what happened instead.
Most questions we receive are covered below. The app stores everything only on your own device, which is what makes it private — and also what makes a few of these answers blunter than you might expect.
On the unlock screen, tap Forgot master password? Reset it and answer all five security questions. If they match, you set a new master password and all of your entries are preserved.
The app cannot show you your old master password. It never stored it — only a key derived from it — so there is nothing to look up. That is deliberate: a password manager that can recover your master password can also be compelled or breached into revealing it.
Wrong answers are deliberately rate-limited. After four failed attempts the waiting period grows: 30 seconds, then 2 minutes, 10 minutes, 30 minutes, and finally an hour between tries.
Then the data cannot be recovered — not by you, not by us, not by anyone. There is no copy on a server, no backdoor, and no reset link, because there is no server. If you have an encrypted backup file and remember its passphrase, use Restore from an encrypted backup on the unlock screen. Otherwise the vault is lost. We are sorry; this is the direct cost of the app holding nothing about you.
The free version holds 20 entries. Once you reach 20, the Add entry button is disabled until you delete one, or until you buy more capacity. Editing and deleting existing entries keeps working normally, and nothing you have already saved is affected.
Everything other than the entry count is unlimited: custom fields per entry, searching, the password generator, biometric unlock, encrypted backups and CSV import and export are all fully available, and none of it is time-limited.
If you restore a backup or import a CSV containing more than your limit, the entries that fit are kept and the rest are discarded. The app tells you how many will be left out before you confirm, so check that screen if you are restoring a large backup.
They buy vault capacity, and nothing else:
| Plan | Entries |
|---|---|
| Free | 20 |
| Plus | 100 |
| Pro | 500 |
| Ultimate | 1,000 |
| Unlimited | No limit |
Each is a one-time purchase, not a subscription. Nothing renews, nothing expires, and you are never billed again for a plan you bought. Encryption, biometric unlock, backups, the generator and every other feature are identical on every plan, including free — nothing is held back or deliberately weakened to sell you an upgrade.
Google Play does not offer trade-ins for one-time purchases, so moving from Plus to Pro means buying Pro; the amount you paid for Plus is not credited. Prices are shown by Google Play in your own currency before you confirm.
Open Settings → Upgrade and tap Restore purchases. The app also checks with Google Play each time it starts.
A purchase is tied to the Google account that made it, so check you are signed in to Play with the same account. If Google Play is unreachable, the app keeps the plan it last confirmed, so being offline never costs you capacity you paid for. If you paid by cash or bank transfer, Google Play may take time to clear the payment; the plan updates once it does.
In every case your entries are untouched while this is sorted out. A plan limits only how many new entries you can add — it never hides, deletes or locks what you already saved.
Android's cloud backup is switched off for this app on purpose, so your vault does not transfer automatically. Move it yourself:
.opwbackup file somewhere you can reach from the new phone.Biometric unlock does not transfer — it is tied to the hardware key store of the original device. Turn it back on in Settings after restoring.
Uninstalling deletes the encrypted vault along with the app, and nothing else holds a copy. If you have an encrypted backup, restore it as above. If not, the data is gone. Take a backup before uninstalling, changing phones, or resetting a device.
This is expected after certain changes and is a security feature, not a fault. Android permanently invalidates the app's biometric key when you add or remove a fingerprint or face, or change your device's screen lock. The app detects this, turns biometric login off, and asks for your master password instead. Unlock with the master password, then re-enable it in Settings → Security → Biometric login.
That is intentional. Block screenshots / screen recording is on by default so your passwords cannot be captured by other software or appear in the app-switcher preview. You can turn it off in Settings → Security if you need to capture the screen.
Use Menu → Import / Export → Import CSV. The importer expects a semicolon-delimited CSV whose first row is the column names:
Title;Category;Username;Password;Website;Comments
PIN, Account Number, anything you like.If your other manager exports comma-delimited CSV, open it in a spreadsheet and re-save it with semicolons.
No. CSV export is plain text — that is what makes it readable by other programs. Anyone who gets the file can read every password in it. Use it only to move between managers, and delete it as soon as you are done. For keeping a copy, use the encrypted backup instead.
Settings → Security → Auto-lock timeout: 30 seconds, 1, 2, 5 (default), 10 or 30 minutes, or Never. The vault also locks when you leave the app for longer than that period.
Leaving the app with the back button locks it immediately, whatever the timeout is set to. From the entry list, press back once — you will see “Press back again to lock and exit” — then back again to leave. Reopening asks for your master password or biometrics.
Copied passwords are cleared automatically after 30 seconds by default, so they don't sit in the clipboard for other apps to read. Adjust the delay with the Clipboard auto-clear slider in Settings → Security.
At least 10 characters and at least three different kinds of character (lower case, upper case, digits, symbols). There is no maximum length — a long passphrase is a good choice. The strength meter is guidance only.
No, and it never will. Nothing you store is ever transmitted — the only network access in the app is Google Play's purchase system. Moving data between devices is done with the encrypted backup file, by you.
No. This is an Android app only.
Please open an issue on GitHub and include:
| Include | Do not include |
|---|---|
|
Android version and phone model App version (Settings, bottom of the screen) What you did, what you expected, what happened The exact wording of any error message |
Passwords or your master password Security-question answers Your vault file or a CSV export Screenshots that show real credentials |
If you believe you have found a vulnerability, please email walletp85@gmail.com rather than opening a public issue, and give us a reasonable opportunity to fix it before disclosing it publicly. Include enough detail to reproduce the problem. The app's threat model and its known limitations are documented in the project README — please check there first, since some behaviour that looks like a weakness is a documented trade-off.