Join 5,000+ subscribers getting weekly tips on web development, mobile apps, and AI solutions.
A local-only WebAuthn/FIDO2 passkey authenticator for Android. No cloud account, no telemetry, no network permission at all — private keys are generated inside Android Keystore and never leave this device, even to sign in from another one.
WHY WE BUILT IT
Every mainstream passkey option routes through a cloud account — Google, Apple, or a third-party vault — even though the whole point of a passkey is that the private key never has to leave your device. We wanted an authenticator that actually holds to that: no account to lose access to, no vendor relay in the cross-device path, nothing to trust but this app and this phone's own hardware.
WHAT IT DOES
Standard COSE keys, standard authenticatorData, hardware attestation (fmt: "android-key") rooted in Android's own attestation chain — not a proprietary format.
Every passkey's private key is generated inside Android Keystore (StrongBox-backed where available) and is non-exportable — never held as raw key material, never recoverable by us.
Every sign-in requires a fresh fingerprint or face check, bound directly to that one signature by the OS and hardware — not just to unlock the app.
No INTERNET permission in the manifest at all. No account, no cloud sync, no analytics — structurally incapable of a network call.
Scan a QR code to sign in to a website from a nearby browser, over a direct, encrypted, single-use Bluetooth connection — no cloud relay in between.
A passkey registered for one site cryptographically cannot be used on a different one, even a convincing lookalike — the core guarantee passkeys exist for.
SECURITY DESIGN
A passkey app's entire value is the keys it holds. Every decision below optimizes for keys that never leave secure hardware and signatures that require a real, fresh biometric check — over convenience.
Private keys exist only inside Keystore — not this app, not another app, not even HostSpica can get them out.
Cross-device sign-in needs a bonded, encrypted Bluetooth connection in physical range — not a server anywhere in the world.
A rooted device shows a clear warning that Keystore guarantees may not hold — it never hard-blocks the app.
SIGN IN FROM ANYWHERE
Register as a system credential provider once, then any app or site that supports passkeys can offer this app as the option — a biometric prompt is all that stands between you and signing in.
Scan the QR code a website shows on a laptop or another phone. This app opens a direct Bluetooth connection to that browser and completes the sign-in — nothing routes through the cloud.
BUILT WITH
QUESTIONS
No. The app declares no network permission at all. Signing in on this device works fully offline; signing in from another device uses a direct Bluetooth connection, not the internet.
Inside this device's Android Keystore, hardware-backed and non-exportable. There is no cloud account and no HostSpica server holding a copy — nothing to leak, nothing for us to see.
Scan a QR code shown by the website with this app. It opens a direct, encrypted Bluetooth connection between your phone and that browser to complete the sign-in — no cloud relay, no account linking.
Not yet. The app already implements the real WebAuthn/FIDO2 protocol with genuine hardware attestation; formal FIDO Alliance certification is a separate, paid process the team plans to pursue once funded.
HostSpica Passkey is in final testing. Check back here or watch HostSpica Labs for the Play Store link once it's live.
Back to Labs