Isang ledger, walong identity
Bawat sensitibong field ay naka-encrypt gamit ang AES-256-GCM, na may sariling random na IV.
Ang iyong mga password, nasa kontrol mo.
Protektahan ang iyong mga password, passkey, 2FA, at bank card gamit ang AES-256-GCM encryption. Lokal muna, opsyonal na iCloud sync.
Built on modern iOS primitives
Isang ledger, sa iyo lang. Walang ikatlong kopya, kahit saan.
Hindi 'password app' — isang encrypted ledger na pinagsasama-sama ang lahat ng digital identity sa isang lugar. Ang lahat ng sensitibong field ay independenteng naka-encrypt gamit ang AES-256-GCM, at locally lang nababasa.
Walang kailangang pangalawang app
I-scan para mai-save. Pinupuno ng AutoFill ang 6-digit code kasama ng password.
Isang malakas, sa isang segundo
Random na string o EFF wordlist phrase. Live na entropy meter.
FIDO2 / WebAuthn
Generated at naka-store nang lokal. Hindi umaalis sa device ang private key sa plaintext.
HIBP · k-anonymity
Ang unang 5 chars lang ng SHA-1 hash ang umaalis sa device. Ang password mo ay hindi.
Safari · apps · keyboard — isang hakbang
System-level AutoFill extension. Kinukumpirma ng Face ID; pinupuno din ang mga code.
End-to-end · opsyonal
Naka-route via Apple's private CloudKit. Ang mga sensitibong field ay naka-encrypt sa device bago i-upload — ciphertext lang ang lumipat-lipat ng device.
Sa iyo, anumang oras
1Password · Bitwarden · LastPass · KeePass · Dashlane · Apple Keychain. Tatlong export format: JSON / CSV / 1PUX.
Mali ang edit? Aksidenteng nabura? Mababawi.
Bawat password change ay nagse-save ng dating value — hanggang 5 history versions, one-tap rollback. Ang nabura ay napupunta sa Trash.
Nagco-countdown ang clipboard. Nag-lock ang app sa sarili.
Ang pasteboard ay auto-clear sa 5 preset (15-90s); ang foreground / background auto-lock ay magkahiwalay na configurable.
I-tap mula sa lock screen, nandiyan na ang password
Dalawang widget: mabilis na vault access + on-the-fly password generator.
Tatlong bagay na hindi ko ipinagpalit
Built-in TOTP, on-device security audit, at Passkey — ang tatlong lugar kung saan pinaka-malinaw na lumalampas ang ByteGuard.
Codes, without juggling two apps.
Scan to save — every 2FA in one place. The detail page shows the live code with a countdown ring; long-press to copy. With AutoFill, the code goes in along with username and password.
- RFC 6238 TOTP, 6/8 digits · SHA-1 / 256 / 512 HMAC
- iCloud cross-device sync (E2E encrypted, Premium)
- Three export formats: JSON / CSV (plaintext) + encrypted .bytegx
You can only fix what you can see.
Backed by Have I Been Pwned with the k-anonymity protocol — only the first 5 chars of the SHA-1 hash ever leave the device. Every weakness comes with a concrete next step.
- Detects leaked / weak / reused / outdated
- HIBP k-anonymity (SHA-1 prefix-5); plaintext never sent
- One tap jumps to the entry to replace
Private keys never leave the device.
WebAuthn / FIDO2 standard. ES256 (ECDSA P-256, COSE alg -7). Private keys are AES-256-GCM encrypted with the Item Key — plaintext never written to disk. AutoFillExtension handles registration and assertion via the Apple system bridge.
- ES256 (ECDSA P-256, COSE -7)
- AutoFill Extension handles registration + assertion
- iCloud E2E encrypted sync (Premium)
Ito ang aktwal na hitsura nito
Sampung screen, sa pagkakasunod-sunod ng senaryo — ang buong app, dinaanan. Walang marketing copy.
Every digital identity, in one place.
Top 10 / All / Favorites / Logins multi-view; live filtered search. All eight DataType cases run the full field-level encryption pipeline — not a 'password app', but a digital-identity ledger.
- 8 types: login / card / API key / identity / note / license / passkey / OAuth token
- Each entry gets its own AES-256-GCM key; plaintext never leaves the device
- Local-first; optional iCloud end-to-end encrypted sync
Codes, without juggling two apps.
Scan to save — every 2FA in one place. The detail page shows the live code with a countdown ring; long-press to copy. With AutoFill, the code goes in along with username and password.
- RFC 6238 TOTP, 6/8 digits · SHA-1 / 256 / 512 HMAC
- iCloud cross-device sync (E2E encrypted, Premium)
- Three export formats: JSON / CSV (plaintext) + encrypted .bytegx
One entry — every field at once.
Login detail: username, password, history, linked TOTP, website, custom fields. Each sensitive field independently decrypted with its own IV, shown only on demand. Copy auto-clears the clipboard.
- Each sensitive field independently AES-256-GCM encrypted with its own IV
- TOTP / Passkey two-way linking shown together
- Copy auto-clears clipboard (5 presets)
Made a typo? Deleted by mistake? Recoverable.
Every change saves the previous value (spec:R3 — up to 5 versions kept); tap the timeline to restore. Deleted items are retained for 90 days before permanent removal.
- Up to 5 history versions kept
- Four source markers: manual / AutoFill / imported / sync
- Deleted items retained 90 days
You can only fix what you can see.
Backed by Have I Been Pwned with the k-anonymity protocol — only the first 5 chars of the SHA-1 hash ever leave the device. Every weakness comes with a concrete next step.
- Detects leaked / weak / reused / outdated
- HIBP k-anonymity (SHA-1 prefix-5); plaintext never sent
- One tap jumps to the entry to replace
A strong one — in one second.
Random (4-64 chars / exclude look-alikes / digits-only for PIN) or EFF passphrase, with live entropy meter. Replaces the old value and records the change in history.
- Two modes: random (incl. PIN) + EFF passphrase
- Apple system CSPRNG (Swift Int.random + SecRandomCopyBytes)
- Live entropy meter and strength indicator
Tap in Safari, and the password fills itself.
AutoFill Extension uses Apple's official ASCredentialProviderViewController; after Face ID / Touch ID, the username, password and TOTP all go in together. Info.plist also declares SupportsSavePasswordCredentials, so new passwords save back to ByteGuard from any flow.
- ASCredentialProviderViewController, system-level credential provider
- Safari + third-party apps, all flows covered
- Unlock via Face ID / Touch ID; TOTP delivered in the same step
Private keys never leave the device.
WebAuthn / FIDO2 standard. ES256 (ECDSA P-256, COSE alg -7). Private keys are AES-256-GCM encrypted with the Item Key — plaintext never written to disk. AutoFillExtension handles registration and assertion via the Apple system bridge.
- ES256 (ECDSA P-256, COSE -7)
- AutoFill Extension handles registration + assertion
- iCloud E2E encrypted sync (Premium)
PAN encrypted, CVV never stored.
Card number (PAN) gets its own AES-256-GCM key with a unique IV. Cardholder name, expiry, brand (Visa / Mastercard / etc.) stay searchable as metadata. CVV/CVC are never persisted on this device.
- PAN encrypted; BIN (first 4-6) / last 4 shown in plaintext
- CVV/CVC never persisted on device
- Cardholder / expiry / brand / billing-address metadata
Dark / Light / System.
AppearanceMode three modes: system / light / dark — switch any time, no restart. Premium tier unlocks multi-color themes; Home Screen widgets stay in sync.
- AppearanceMode three modes: system / light / dark
- Multi-color themes (Premium)
- Home Screen widgets follow theme
Zero-knowledge, sa literal na kahulugan.
Ang master password mo ay hindi kailanman umaalis sa device. Ang Secret Key mo ay locally generated at naka-store sa Apple's end-to-end encrypted Keychain — kahit Apple ay hindi ito mababasa.
Argon2id key derivation
password + Secret Key + 32B salt → Master Key. Parameter: 64 MB memory · 3 iterations. Resistant sa GPU/ASIC attacks.
HKDF-SHA256 key hierarchy
Master Key → KEK → random DEK. Bawat vault ay may sariling DEK — walang horizontal decryption path.
Field-level AES-256-GCM
Bawat sensitibong field ay independenteng naka-encrypt · bagong random IV sa bawat write. Parehong plaintext → magkaibang ciphertext.
128-bit Secret Key
Isang random key (12-word BIP39 mnemonic ang anyo), independyente sa master password. Kahit malaman ang master password, hindi pa rin ma-decrypt.
Hindi ito 'ayaw' — architecturally na 'hindi pwede'.
- Tingnan, i-access, o i-decrypt ang naka-store mong data
- I-reset ang master password mo
- Bawiin ang vault nang walang Secret Key mo
- Ibigay ang decrypted data sa kahit sino — sa arkitektura, walang sinuman ang makakapag-decrypt nang walang master password mo
- Maglagay ng backdoor sa encryption flow
- Mangolekta ng analytics o crash report
What I built. What I chose not to.
No competitor table. No checkmarks. Just an indie developer listing — plainly — what I wrote, and what I deliberately didn't. Read it, then decide whether to trust me with your ledger.
— WHAT I BUILT —
Field-level AES-256-GCM
Every sensitive field encrypted independently, with its own random IV.
Argon2id key derivation
64 MB memory × 3 iterations — resistant to GPU/ASIC brute force.
128-bit Secret Key
A random key independent of the master password — your second line of defense.
Full offline mode
iCloud sync can be turned off in one tap; the app falls back to pure local storage.
HIBP k-anonymity lookup
Only the first 5 chars of the SHA-1 hash are sent — your password never leaves the device.
Native system integration
AutoFill, Passkey, and TOTP all use Apple's official APIs. No reinvented wheels.
Zero third-party SDKs
No analytics. No tracking. No ads. No crash reporters.
— WHAT I CHOSE NOT TO —
No web app or browser extension
XSS, extension supply-chain attacks, CDN takeovers — that surface is excluded by architecture, not policy.
No Android or Windows builds
Each platform means re-implementing the crypto primitives correctly. Get one line wrong and the whole chain breaks.
No team or enterprise sharing
Sharing is trust delegation — I'm still working out how to do it right. Until I am, I won't ship it.
No self-hosting option
Under zero-knowledge, self-hosting just shifts the operational burden to you with no real security gain.
No third-party audit yet
Honestly: I haven't paid for one yet. The /security page documents every crypto decision against the source so anyone can verify independently. Independent audit + open-sourcing the crypto core are both on the 2026 roadmap — follow the GitHub repo to be notified when they land.
No "recover master password" path
If I could recover it, it wouldn't be zero-knowledge. The most reliable backup is still old-school: write your master password and Secret Key on paper and store them apart.
No aggressive release cadence
Crypto-related changes will move very conservatively. Stability over novelty.
Simple. Patas. Ikaw ang bahala.
Walang nakatagong bayad. Mag-subscribe buwan-buwan, taon-taon, o bumili nang minsan para habambuhay. Lahat ng billing ay hawak ng Apple.
Tungkol sa app, at sa taong gumawa nito.
Sino ka? Bakit kita pagkakatiwalaan sa mga password ko?
Indie developer ako. Ang ByteGuard ay ako mismo ang sumulat — walang team, walang funding, walang third-party na security review. Code ang sasagot — basahin ang white paper, suriin sa GitHub, at i-test kung naaayon sa pangangailangan mo. Ang tiwala ay dapat ibase sa nakikita, hindi sa branding.
Paano kung makalimutan ko ang master password ko?
Hindi ko ito mababawi. Iyan ang halaga ng zero-knowledge: hindi ko ma-reset ang hindi ko alam. Gamitin ang Face ID / Touch ID para sa araw-araw, at mag-set up ng emergency recovery — isulat ang Secret Key at iyong master password sa ligtas na lugar.
Paano kung mawala ang Secret Key ko?
Depende ito kung in-enable mo ang iCloud Keychain sync para sa Secret Key. Kung in-enable, ito ay nasa Apple's end-to-end encrypted Keychain at maibabalik mula sa ibang Apple device. Kung hindi, kailangan mo ang nakasulat na backup.
Talagang ligtas ba ang iCloud sync? Walang nakikita ang Apple?
Lahat ng sensitibong field ay naka-encrypt gamit ang AES-256-GCM bago umalis sa device. Ang natatanggap ng iCloud ay ciphertext lang. Kahit kompromisuhan ang account ng Apple mo, hindi pa rin ma-decrypt nang walang master password mo.
Bakit walang Android / Windows / Web?
Dalawang dahilan. Limitado ang code na kayang i-maintain ng isang tao, at ang cross-platform ay nangangahulugang i-implement muli ang crypto core nang paulit-ulit — bawat platform ay isa pang attack surface. Mas pinili ang lalim sa Apple ecosystem kaysa lawak.
Mahirap bang lumipat mula sa 1Password / Bitwarden?
Direktang import mula sa 1Password / Bitwarden / LastPass / KeePass / Dashlane / Apple Keychain export file. Karaniwang ilang minuto lang. Tingnan ang detalyadong gabay sa import sa loob ng app.
Tataas ba ang presyo? Magiging subscription ba ang lifetime tier?
Permanente ang $9.99 lifetime at kasama ang lahat ng future updates. Kahit magkaroon ng 'premium subscription' tier, ang lifetime mo ay hindi maaapektuhan — iyan ang pangako.