Built for speed, quiet by default
Simple interactions, sensible defaults, and clear boundaries. Every feature is structured to keep sensitive data on your hardware.
Masked until requested
Credentials and private notes stay hidden until you tap to reveal or copy them. Decrypted keys live in volatile memory and are purged the moment the vault locks.
Two taps from unlock to copy
Biometric authentication opens directly into a one-tap copy button. The clipboard automatically wipes 60 seconds later to protect against clipboard snoopers.
Color conveys state, not decoration
Interface colors communicate real state. Amber and red signal weak passwords or destructive choices, while neutral tones present data cleanly without noise.
Destructive actions require confirmation
Wiping a vault or deleting credentials requires a deliberate hold and confirmation prompt so you cannot erase data accidentally.
No accounts, no remote recovery
You never register an email or create a cloud profile. Your 12-word seed phrase is your personal recovery path.
How LoQ protects your data
Standard authenticated ciphers, high-iteration password hashing, and local device keys. Here is how the security layer is implemented.
PBKDF2 key derivation & AES-256-GCM
310,000 iterations and authenticated encryption
Your master password is processed using PBKDF2-HMAC-SHA256 with 310,000 iterations and a random 16-byte salt, following NIST guidelines to resist brute-force cracking. Vault data is encrypted with AES-256-GCM using unique nonces and tamper-evident authentication tags. Passphrase verification uses constant-time comparisons to prevent side-channel timing leaks.
12-word seed phrase recovery (BIP-39)
Deterministic key derivation for offline recovery
When you create a vault, LoQ generates a standard 12-word BIP-39 recovery phrase with 128 bits of entropy. Hierarchical deterministic paths separate identity verification (m/0'/0) from symmetric vault keys (m/1'/0). If you forget your master password, your seed phrase mathematically reconstructs access without contacting a server.
Relative monotonic auto-lock
Resistant to device clock changes
Session auto-lock uses relative monotonic timers (performance.now()) rather than the operating system date and time. Changing the phone's clock cannot bypass the auto-lock screen. Decrypted keys in volatile memory are purged when the timeout expires or the app moves to the background.
Password health and risk audit
Client-side strength scoring and reuse detection
The embedded audit tool checks credentials locally for common risks. It flags duplicate passwords, identifies entries unchanged for over 90 days, and scores password complexity using the zxcvbn entropy model without sending strings to an external API.
Entropy-based password generator
Guaranteed minimum complexity floor
Generates random passwords using device cryptographic entropy, ensuring an even distribution across character sets with unbiased Fisher-Yates array shuffling and a minimum 60-bit entropy floor.
Encrypted backups and printable sheets
Paper and file options for cold storage
Export vault contents to password-encrypted .loq backup archives, structured JSON files, or printable landscape PDF sheets for physical paper cold storage. Updates automatically migrate legacy vault envelopes on login without data loss.
Offline self-custody versus cloud convenience
Cloud password managers offer automatic sync across desktops and browsers. LoQ is built for people who prefer zero network access and complete local custody.
| Feature / characteristic | LoQ (Offline vault) | Standard cloud managers |
|---|---|---|
| Network permissions & sync | No cloud sync; network is limited to in-app update checks (from v2.2.0) | Requires internet access to sync data across devices |
| Data storage location | On-device encrypted database only | Encrypted blob hosted on cloud infrastructure |
| Account requirements | No account, no email address, no personal registration | Requires central account with email and billing setup |
| Multi-device synchronization | Manual export and import using encrypted .loq files | Automatic, instant background sync across devices |
| Browser and desktop autofill | Android mobile app; tap-to-copy clipboard flow | Browser extensions and native desktop autofill |
| Remote server breach risk | Zero remote attack surface; no central database to breach | Central servers remain targets for cloud credential attacks |
| Emergency recovery method | 12-word offline BIP-39 recovery phrase | PDF emergency access kits, email links, or admin resets |
| Clipboard protection | Automatic 60-second memory clipboard wipe | Configurable 30 to 90 second clipboard clearing in apps |
| Licensing and cost | Free and open source with no subscriptions | Freemium or annual subscriptions ($36 to $60/year) |
How to install the LoQ APK
Installing the APK directly gives you full control over the binary without relying on app store accounts.
Verify the checksum (optional)
Confirm binary integrity before opening by checking the SHA-256 hash in a terminal or verification tool.
sha256sum loq-v2.4.1.apkNote: Expected hash: 2006bc9a56bc0a22e3157fd0b03ebfb5f4ad1a084522a5e6b92dc0038b556c8c
Allow installation
When opening the downloaded file, Android may ask to allow installs from your browser or file manager under device settings.
Note: Android restricts sideloading per application to prevent silent background installs.
Create your vault and save your seed
Open LoQ, set your master password, and copy down your 12-word recovery phrase on paper before adding accounts.
Note: Your vault database is stored strictly locally on your device.
Things to know before you start
Because LoQ never connects to the internet, you have full custody of your vault. That also means backups are entirely your responsibility.
No password resets
Because LoQ has no accounts or cloud servers, nobody can reset your password or unlock your data if you forget your master credentials.
Write down your 12-word recovery phrase on paper when you create your vault. Keep it somewhere safe away from your phone.
Your device holds the only copy
All vault data stays on your local device storage. If your phone is lost, damaged, or wiped without a backup, your passwords are gone.
Use the export tool in the app to create encrypted .loq backup files or printable paper sheets to store on an offline drive or home safe.
Answers to common questions
Key details about how LoQ handles encryption, recovery phrases, and offline storage.
Cloud sync requires trusting an external server with your encrypted credentials. LoQ keeps your vault strictly local on your phone. Starting with v2.2.0, the only network request the app makes is checking whether a new version is available.