Is Keyholm safe?

Keyholm is all about single-device passkeys (i.e. client-side discoverable credentials) whose private key is protected by secure hardware. You can never export or sync these passkeys. Think of Keyholm as a way to activate the built-in security key on your phone. target devices: phones with secure hardware (including Pixels) no INTERNET permission no Google Play Services ever takes advantage of la…

Developer: michaelbeaumont
Category: Password & 2FA
Earliest archived version: 15 Oct 2026
License: GPL-3.0-only (per F-Droid metadata)

02 / Release notes

Release notes from F-Droid

15 Oct 2026

0.0.4

Keyholm's first release on fdroid! It's quite feature complete already when it comes to single-device passkeys: - Passkey creation/passkey use as an Android passkey service - Passkey management - Extensive settings for configuring exactly how to create/use your passkeys - PRF support - Passkey list…

Full notes →

03 / Package identity

Technical fingerprint

Application IDapp.keyholm

Latest APK SHA-25634376ab1a083054b3f613894a000fdf5ba61f13c1710db4f5437e155aa3f165c

Signing certificate91:85:C9:57:79:4A:7F:F4:43:F5:BD:45:3B:1C:91:3D:80:BA:D0:D0:9D:14:88:2E:1D:F2:81:C6:81:F0:A9:2E

MIN ANDROID35TARGET37ARCHITECTUREarm64-v8a · armeabi-v7a · x86 · x86_64

04 / Version archive

Documented releases

1 TOTAL

VersionReleasedAndroidArchitecture

0.0.415 Oct 202635+arm64-v8a, armeabi-v7a, x86, x86_64→

05 / Safety & access

Safety verdict

Authentic — file hash matches the source indexNo ads or tracking flagged by the source

IntegritySHA-256 verified vs source

SourceOpen-source · fdroid

Permissions5 declared · 1 sensitive

Signaturepresent

Anti-featuresNo known anti-features

Sensitive accessQUERY_ALL_PACKAGES

Declared permissions

android.permission.HIDE_OVERLAY_WINDOWS android.permission.QUERY_ALL_PACKAGES android.permission.USE_BIOMETRIC android.permission.USE_FINGERPRINT app.keyholm.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Tracker status: Not assessed by WIKI for Android.

06 / Sources

Evidence ledger

Each entry is a captured public reference backing this record.

RepositorySource package page↗Source codeSource repository↗