Local-first & offline
All authentication and enforcement happen on-device. There are no servers involved, and the only optional network use is a GitHub update check.
Security
Security
How Open Lock protects your PIN, your config, and the lock itself — described honestly, including where the limits are.
Authentication
Your PIN is stored only as a salted PBKDF2-HMAC-SHA256 verifier — never the raw PIN. Repeated wrong entries trigger an escalating cooldown. Biometric unlock uses AndroidX BiometricPrompt with the PIN always available as a fallback.
Encrypted configuration
Your full config is encrypted with AES-256-GCM under a key held in the Android Keystore. If the Keystore is unavailable, Open Lock fails closed — it never writes the verifier in plaintext.
Backups
.olbackup files are encrypted with AES-256-GCM under an Argon2id key derived from a passphrase you choose — separate from your PIN.
Screenshot / Recents protection
FLAG_SECURE is set on both the main app and the lock screen, keeping sensitive content out of screenshots and the Recents preview.
Backup flag
android:allowBackup="false" keeps app-private data out of system and cloud backups.
Lock enforcement
Enforcement combines UsageStatsManager, an overlay lock screen, and a foreground service — never an accessibility service. It's best-effort: timing depends on OS polling and OEM background limits, so we don't overclaim.
Uninstall protection
Optional device-administrator status blocks the normal uninstall flow, and disabling it is auth-gated. Honest limit: ADB, Safe Mode, or a factory reset can still remove any non-system app — it's a deterrent, not a guarantee.
Intruder protection
After repeated failed attempts, Open Lock can silently capture a front-camera photo and log the time and app. Photos stay in app-private storage.
Reporting a vulnerability
Please report security issues privately via the GitHub Security tab rather than a public issue.
What we do NOT claim
Open Lock is not "unhackable" or "100% secure", and it isn't military-grade anything. Cross-app locking on Android is best-effort and depends on OEM behavior and timing. Open Lock is a strong deterrent against casual access — not a guarantee against a technical adversary with physical access to your unlocked device.