An offline password vault for iOS and Android
Your passwords in a box. And the box stays with you.
KutunaCo is an offline, account-free password vault and subscription tracker for iOS and Android. Your passwords, cards, API keys and notes stay encrypted with AES-256 on your phone, and nowhere else.
- Download on the App Store
- Get it on Google Play
What goes in the box?
Four kinds of things, one search bar. Tag them, star them, sort them.
- 01
Passwords
Username, password, website and the linked app. Your 2FA codes can live here too.
- 02
Cards
Number, expiry and CVV. The list only ever shows the last four digits.
- 03
API keys
Service name and key. For developers, without the mess.
- 04
Secure notes
Wallet seed phrases, door codes, the things you tell no one.
- 05
Subscriptions
Add a fee and a billing cycle to any item; KutunaCo totals it up monthly and yearly and shows what renews next.
- 06
Password health
Find weak, reused, old and 2FA-less passwords and see your score out of 100. Entirely offline.
Everything goes in the box. Then you close the lid. Nothing gets out.
Everything goes in the box.
Nothing gets out.
Then you close the lid.
Only you know what’s inside.
- 0 accounts
- 0 servers
- 0 network requests
- 0 ads
- AES-256 encrypted vaultThe key lives in iOS Keychain or Android Keystore, on this device only.
- No internet permission on AndroidThe app can’t make a network request, even if it wanted to.
- Biometrics or PINFace ID, fingerprint, device passcode or a 4–8 digit app PIN. Auto-lock, hidden in the app switcher.
- Your backup, your keyBBX2 backups are sealed with Argon2id + AES-256-GCM. Forget the password and nobody, including us, can open it.
- A clipboard that forgetsCopied passwords are flagged sensitive and wiped from the clipboard after the time you choose.
- Nothing on cameraScreenshots and recording are blocked on Android; on iOS the content hides in the app switcher and during screen recording.
- Never silently lostIf the vault can’t be opened, nothing is deleted; a recovery screen offers your options.
The app lock is a UI lock; the vault key is tied to the device’s own lock. The full security model
You hold the key.
Moving in is easy
Hand KutunaCo the file you exported from Chrome, Apple Passwords, Bitwarden, 1Password, KeePass, Proton Pass and more; it recognises it and imports it. Your Aegis, 2FAS and Google Authenticator codes come along too.
Import guide- Chrome
- Edge
- Apple Passwords
- Firefox
- Bitwarden
- 1Password
- KeePass
- KeePassXC
- Proton Pass
- LastPass
- Enpass
- Dashlane
- NordPass
- RoboForm
- Aegis
- 2FAS
- Ente Auth
- Google Authenticator
- CSV
- BBX2
Right there in every login form
Android Autofill and iOS AutoFill. Every fill asks you to authenticate; suggestions only appear in the verified app or on the matching domain.
Welcome back
Sign in to your account
Passwords made of words
From characters or from words: you pick the length, the symbols and whether look-alike characters are allowed. The generator uses Random.secure and remembers nothing.
This demo runs in your browser; nothing is sent or stored.
Password Generator
Get your box. Close the lid.
- Download on the App Store
- Get it on Google Play
Questions, answered
If the answer isn’t here, it is most likely in the app’s privacy policy.
What is KutunaCo?
KutunaCo is an offline, account-free password vault and subscription tracker for iOS and Android. It keeps passwords, credit cards, API keys and secure notes encrypted with AES-256 on the phone only, generates 2FA codes, checks password health and adds up your subscriptions monthly and yearly.
Does KutunaCo really never connect to the internet?
Correct. The app makes no network requests; the Android build doesn’t even hold the internet permission. There is no account, server, sync or analytics.
Do I need an account?
No. Install the app and choose your lock; that’s it.
What encryption does KutunaCo use?
The vault and settings are encrypted with AES-256; the key is kept in the iOS Keychain or Android Keystore, on that device only. Backups use the BBX2 format: AES-256-GCM under a key derived from your password with Argon2id.
Do 2FA codes work without the internet?
Yes. TOTP codes are generated entirely on the device from the secret you add to the item and the phone's clock; no connection is needed.
Does my vault go into iCloud or Google backups?
On Android, app data is excluded from device and cloud backups. On iOS the encrypted vault file may be included in a device backup, but the key that opens it stays on that device, so it cannot be opened elsewhere. Use a BBX2 backup to change phones.
How does autofill work?
You choose KutunaCo as the autofill service on Android or as a password provider on iOS. Every fill asks you to authenticate, and suggestions only appear in the verified app or on the matching domain.
What happens when I change phones?
The vault is tied to the device; it does not move with an iCloud or Google backup. Make a password-protected BBX2 backup on the old phone (Settings › Backup) and import it on the new one.
What if I forget my PIN?
If your device has a screen lock or biometrics, verify with it and set a new PIN. Otherwise the only way is to delete all data and restore from a backup.
How safe is my backup file?
BBX2 backups are encrypted with AES-256-GCM using a key derived with Argon2id; weak and common passwords are rejected. If you forget the password, no one can open it.
Can I move from another password manager?
Yes. Exports from Chrome/Edge, Apple Passwords, Firefox, Bitwarden, 1Password, KeePass, Proton Pass, LastPass, Enpass and generic CSV are supported, plus 2FA transfers from Aegis, 2FAS, Ente Auth and Google Authenticator.
Which languages does the app support?
Turkish for now. An English interface is on the roadmap.
Is it paid?
Yes, KutunaCo is a one-time purchase. There are no in-app purchases, subscriptions or ads.
How do I delete my data?
Settings › Data Management › Delete All Data, or simply delete the app. Since nothing is stored on a server, there is nothing else to remove.
How does subscription tracking work?
Add a fee, currency and billing cycle (weekly, monthly, quarterly, yearly) to any item; the “Subscriptions” filter on the home screen shows monthly and yearly totals and what renews next.
Does it check whether my passwords were leaked?
No. KutunaCo never goes online, so it cannot query an outside breach list such as Have I Been Pwned. Instead it offers a password health report that finds weak, reused, old and 2FA-less passwords entirely on the device.
Does KutunaCo support passkeys?
Not at the moment. KutunaCo stores usernames and passwords, 2FA codes, cards, API keys and secure notes; passkeys are not supported.