Home / IvyKey for Android: User Guide

Android guide

IvyKey for Android: User Guide

Applies to: Android 1.0 (test build). Last updated: 2026-11-02. IvyKey has not yet been independently security audited. During testing, don't keep your real passwords only in IvyKey.

1. Read these three things first

  1. There is no password recovery service. If you forget your master password and also lose your recovery key, your data can never be recovered.
  2. Uninstalling = your data is gone. Uninstalling IvyKey, choosing "Clear data" in system settings, or installing a build with a different signature (for example, replacing the test build with the release build) deletes the vault on the phone. Copy backups to a computer or USB drive often.
  3. IvyKey has no network permission. It never uploads anything and is not included in Google cloud backup; you sync and back up by copying files yourself.

2. Getting started

Starting fresh: tap "Create a new vault" → set a master password (we suggest "Generate passphrase" and writing it on paper) → save your recovery kit (write it down or print it, then enter two of its groups to confirm) → export your first backup.

You already have a vault on a computer:

  1. In IvyKey on the computer, "Export sync copy".
  2. Connect the phone to the computer with a USB cable, choose "File transfer" on the phone, and in the computer's file manager drag the copy into the phone's Download folder.
  3. On the phone, tap "Start from a computer's sync copy", choose that file, and enter the master password of the vault on the computer.

3. Everyday use

  • New entries: tap "New" at the bottom right and choose a type first (Login, Bank card, ID document, API key, Server, Wi-Fi, Software licence, Secure note).
  • Categories: the menu at the top left opens the side panel, where you can browse All entries, Favourites, Folders, Tags and Trash. Below them are the Password generator, Password health check, Sync and backup, History and Settings.
  • Viewing a password: tap the "eye" on the entry page. If more than 5 minutes have passed since you last confirmed your identity, IvyKey first asks for your fingerprint or master password. The password hides again after 30 seconds. "Show password in large type" enlarges and numbers each character, which makes it easy to type on a TV or other device.
  • Copying: a copied password is cleared from the clipboard after 30 seconds, even if you have switched to another app. On Android 13 and later, copied passwords don't appear in the keyboard's clipboard history.
  • Notes: a secure note's content is always hidden until you choose Show; a login's "Notes" are shown directly by default. If you keep sensitive things such as security answers there, turn on "Hide login notes by default" in Settings (turning it off again requires your master password).
  • Locking: tap the lock at the top right, or pull down the notification shade and add the "Lock IvyKey" tile to Quick Settings (it is called "锁定常春钥" when the phone's language is Chinese).

4. Auto-lock

  • Pressing the power button to turn the screen off: locks immediately.
  • Switching to another app: locks after 30 seconds by default (you can change this to "Immediately" in Settings).
  • No activity inside IvyKey: locks after 5 minutes by default.

When IvyKey locks, the keys in memory are wiped and any revealed text on screen is cleared.

5. Fingerprint unlock

Turn it on in Settings › Quick unlock › Unlock with fingerprint (you enter your master password once, then touch the fingerprint sensor once).

  • Your fingerprint is just another key to the door. That key is locked inside the phone's secure hardware, and IvyKey never gets your fingerprint.
  • After the phone restarts, or when more than 24 hours have passed since you last entered the master password (adjustable from 1 to 72 hours), you must enter the master password. This stops someone from using your finger while you sleep or by force.
  • If you add or remove a fingerprint in the phone's system settings, IvyKey's fingerprint unlock turns off automatically; enter your master password and turn it on again.
  • The Settings screen shows where the key is stored: a dedicated security chip (StrongBox) is best; a trusted execution environment (TEE) is also hardware protection.

5a. PIN unlock (phones without a fingerprint sensor)

Turn it on in Settings › Quick unlock › Unlock with PIN: enter your master password once, then set a PIN of 6–12 digits (entered twice).

  • This PIN is only for IvyKey. Don't reuse your phone's screen lock or a bank card PIN, and avoid easy guesses such as birthdays, 123456 or 123123 (IvyKey refuses them).
  • Once it is on, the unlock screen, "Confirm your identity" and Autofill all ask for the PIN by default; you can tap "Use master password" at any time.
  • After 5 wrong tries in a row, PIN unlock turns off automatically and the master password is required; you can then set it up again.
  • As with fingerprints: after the phone restarts, or when more than the set number of hours have passed since you last entered the master password, you must enter the master password.
  • Only one of fingerprint and PIN can be on; turning one on turns the other off. On phones with a fingerprint sensor, fingerprint is recommended, because it is harder to crack than a PIN.
  • The phone must have a screen lock before you can turn it on.

6. Autofill

Turning it on: Settings › Autofill › "Set as autofill service…", then choose "IvyKey" on the system screen (it is shown as "常春钥" when the phone's language is Chinese).

A phone can only have one autofill service at a time. On phones with Firefox, Google and so on installed, the selected service may be one of theirs (for example "Firefox"), and IvyKey's suggestions won't appear. It is set up correctly when IvyKey's Settings screen shows "✓ IvyKey is the current autofill service".

Chrome users need one more step: Chrome uses its own password manager by default. In Chrome, open Settings › Autofill services › choose "Autofill using another service", then restart Chrome. Firefox doesn't need this step.

Using it: tap a login field on a web page or in an app, and IvyKey's suggestions appear above the keyboard (Android 11 and later, with a keyboard that supports it, such as Gboard) or below the field. Tap one → use your fingerprint or enter your master password → it is filled in. IvyKey never fills anything you didn't tap.

  • How URLs match: by main domain. If the entry says www.google.com, it also appears on accounts.google.com; look-alike addresses such as google.com.evil.cn don't match. To fill only on the exact same address, edit the entry and turn on "Autofill only on this exact host name" under that URL.
  • Two-page logins (Google, Microsoft and others ask for the username first and the password on the next page): the first page fills the username, and on the second page IvyKey lists the same entry first.
  • Other apps (banking, shopping and so on): the first time you fill in an app, choose the entry to use. IvyKey shows the app's name and signature; make sure it was installed from a trustworthy source. Once you confirm, the link is remembered and the entry is suggested directly from then on. An app whose signature changes (for example, replaced by a fake version) is treated as a different app and must be confirmed again.
  • URL mismatch warning: if you choose an entry in a browser whose URL doesn't match, IvyKey warns you that phishing sites often imitate well-known websites. Only continue if you are sure it is the same website.
  • http (unencrypted) web pages: IvyKey warns you before filling that the password could be intercepted.
  • Saving new passwords: after you log in to an app or website with a new username and password, the system asks "Save to IvyKey?". Tap Save → confirm your identity → choose "Save as new entry" or update the password of an existing entry. On some phones (such as Android 14), tapping Save doesn't open IvyKey directly; instead a notification "Save to IvyKey: Tap to finish saving" appears, and you tap it to continue (valid for 5 minutes). That is why IvyKey asks whether it may send notifications the first time you reach the home screen; choose "Allow". If you didn't allow it then, use "Allow notifications…" in IvyKey's Settings › Autofill.
  • IvyKey only trusts the web address reported by mainstream browsers (Chrome, Firefox, Edge, Brave, Samsung Internet, Opera, Vivaldi, DuckDuckGo and others). Any other app is treated as an app, even if it claims to be a website.

7. Syncing with a computer and backing up

Menu › Sync and backup:

  • Export sync copy / encrypted backup: confirm your identity, then choose a location in the system file picker (for example the Download folder). After exporting, IvyKey reads the file back to verify it. Then copy it to the computer with a USB cable and use "Merge import" in IvyKey on the computer.
  • Merge import: choose the sync copy exported from the computer → review the preview (added, updated, deleted, conflicts) → confirm. A history version is saved automatically before merging, so you can undo it in "History". When both sides changed the same entry, you choose which one to keep, or keep both.
  • Replace import: replace the vault on the phone entirely with another vault file (for example after "Rotate vault key" on the computer). The old data on the phone is backed up inside the app first.
  • Verify a backup: checks that a backup opens completely, without changing anything.

If you haven't backed up for more than 30 days, the home screen keeps reminding you.

7a. Moving in from, or out to, another password manager

Menu › Sync and backup › "Other password managers":

  • Import from another password manager: supports KeePass / KeePassXC .kdbx files (enter that file's password), Bitwarden .json (unencrypted) or .csv, and .csv exports from Chrome, Firefox, Apple Passwords and others. You see a preview first (likely duplicates are skipped by default), and nothing is imported until you confirm; a history version is saved before importing. After importing, delete the source file in the Files app, because the passwords in it are usually in plain text.
  • Export as KeePass file (encrypted): set a separate export password; other password managers can import it.
  • Export as plain CSV: unencrypted, and requires your master password. Delete it as soon as you are done.

8. Forgot your master password

On the unlock screen, tap "Forgot your master password? Unlock with recovery key", enter the recovery key from your recovery kit, and set a new master password. A new recovery key is then created; write it down and keep it safe again.

9. Security reminders

  • "Security status" on the Settings screen checks whether the phone has a screen lock, whether the system security patch is too old, and whether any third-party accessibility services are on (such services can read what is on screen).
  • IvyKey's screens can't be captured in screenshots or screen recordings, and Recents shows only a blank card.
  • When another app's overlay (a blue-light filter, a floating button and so on) covers IvyKey, IvyKey ignores taps to stop you being tricked. Close the overlay first.
  • IvyKey asks the keyboard not to learn or record anything typed into any of its fields.
  • Use a phone that still receives security updates. If the system itself has vulnerabilities, any app's protections may be bypassed.

10. Before uninstalling

  1. Export an encrypted backup and copy it to a computer.
  2. Check that "Verify a backup" succeeds in IvyKey on the computer.
  3. Then uninstall. After reinstalling, choose "Start from a computer's sync copy" to get your data back.