Security & provider disclosures
Draft 2026-11-09-us13-preview-locker-3 · private build · legal review pending
Security protections in Developer Locker API
The protection technologies and features used by the Android app.
| Protection | What we use |
|---|---|
| Vault encryption | AES-256-GCM encryption for stored vault information. |
| Passphrase protection | Argon2id protects your vault encryption key using your vault passphrase. |
| Account verification | Your account password plus an authenticator code or compatible passkey. Sensitive account changes require recent verification. |
| Device protection | Android Keystore, supported biometric or screen-lock verification, and screenshot protection. |
| Vault storage | Your working vault is stored encrypted on your phone without automatic cloud synchronization. |
| Encrypted transfers | Up to five selected API keys, tokens, passwords or notes are encrypted with AES-256-GCM before transfer to your chosen receiving browser, where they are temporarily decrypted. Selected items retain their authentication requirements. |
| Encrypted backups | Complete encrypted backups saved to storage you choose, with 24-word recovery. Newly exported backups can also use account password, compatible registered passkey and vault passphrase together. That alternate route uses the passwords from backup creation and requires actual passkey backup support. Keep your backup and recovery information separately. |
| Time away | The vault locks after a ten-minute countdown; account sign-out uses a separate thirty-minute countdown. Both start immediately when you leave the app, or after sixty seconds without activity while it stays open. Activity or returning resets only countdowns that have not expired. A vault timeout does not sign out your account. |
| Clipboard protection | The app attempts to clear its copied value after five minutes if it is still on the clipboard. Clipboard history and copies elsewhere may remain. |
| Online account services | Online services handle account sign-in, security records, verification email and applicable billing separately from your phone vault. |
For added protection, keep Android and your apps updated, install apps from trusted sources, and consider reputable anti-malware software compatible with your device, such as Bitdefender.