About OneVault, and who builds it

OneVault is built and published by RakulAgn, an independent Android developer. Not a company, not a team, and not a venture-funded startup. One person writes the code, answers the support email, and is named on the Privacy Policy as the data controller and on the Terms as the publisher.

That has an obvious downside worth stating plainly: there is no security department behind this app, and no third-party audit has been commissioned. What there is instead is a design that does not require you to trust the developer, and a paper trail you can check.

Most password managers ask you to take their encryption on faith. OneVault publishes the parts that matter, so you do not have to.

The cryptography and the full vault and backup format are at github.com/RakulAgn/onevault-crypto. That repository includes:

• The exact construction: AES-256-GCM for data at rest, with a 32-byte random data key that is wrapped under a key-encryption-key derived by Argon2id (m = 19 MiB, t = 2, p = 1)
• A step-by-step walkthrough for decrypting your own backup by hand, without the app, so you can confirm the format is what we say it is
• An explicit list of what the design does not protect against, which is the section most vendors leave out

The practical consequence of that construction is that your master password never leaves your device and is never sent to any server. It also means a forgotten master password cannot be reset by us, which is why setup hands you a one-time recovery code.

If you find something wrong with any of it, the vulnerability disclosure policy explains how to report it and what we commit to in return.

OneVault is paid for by people buying it: a single one-time purchase, no subscription. There are no ads, no advertising identifiers, no third-party analytics SDKs, and no data broker relationships, because the business model does not need any of that. The Privacy Policy lists the small amount of account data that does get stored and why.

This matters for reading anything on this site: OneVault is a commercial product, and the blog compares it against competitors. Where a post recommends OneVault, that is not a neutral verdict, and the comparisons are written to be checkable rather than flattering. Prices and product claims about other managers link out to those vendors' own pages so you can confirm them at the source.

The posts on the blog are written by the same developer who builds the app. When a post explains how Argon2id or AES-256-GCM works, it is describing decisions actually made in this codebase, with the real parameters, rather than summarising someone else's article.

Corrections are welcome and get made. If a post is wrong, out of date, or unfair to a competitor, email rakul0agn@gmail.com and it will be fixed and dated.

• General and support: rakul0agn@gmail.com
• Security reports: same address with "SECURITY" in the subject, per the disclosure policy
• Code: github.com/RakulAgn/onevault-crypto
• Community: Discord