x2y Authenticator v1.0.5 release notes

Security Center

A centralized security audit was added covering offline vault storage, biometric protection, cloud-sync status, account requirement, backup encryption, backup verification, screenshot protection, clipboard clearing, auto-lock, Stealth Mode configuration and telemetry status. Each condition includes a status, an explanation and a relevant settings shortcut.

Backup v2

Backup envelopes now include a creation timestamp, account count and a SHA-256 integrity checksum. Restore previews include account count, folder count, creation date and format version. Test restore without writing data, merge restore, replace restore, legacy v1.0.0 restore support and timestamped backup filenames such as x2y_vault_YYYYMMDD.x2y were added.

PIN storage

PINs are stored using salted SHA-256 hashes. Existing legacy unsalted hashes remain compatible and are upgraded after a successful unlock.

Auto-lock

Configurable automatic locking was added: immediately, 30 seconds, 1 minute, 5 minutes, 15 minutes or never, plus lock when leaving the foreground and a manual “Lock Now” action.

Clipboard protection

Copied authentication codes can automatically clear after 15 seconds, 30 seconds, 60 seconds or never. A generation guard prevents an older clipboard-clear operation from removing a newer copied value.

Screenshot protection

Screenshot protection became an explicit setting. FLAG_SECURE is enabled by default, applied from the first frame and configurable through Settings.

Biometric settings

Biometric authentication is controlled through an explicit, revocable setting, and the biometric unlock option is hidden when device biometrics are unavailable.

WiFi Companion

Six-character pairing codes, session tokens, per-device revocation, a disconnect-all control, a configurable session timeout, connection history, device identification and client IP reporting were added. Supported session timeouts are 5, 15, 30 and 60 minutes, and locking the vault immediately stops the LAN Companion server.

Privacy and diagnostics

Android permission explanations and exportable diagnostic reports were also added. Diagnostics are secret-free, key-free and account-name-free.

NTP status

Time synchronization now reports the synchronization result, the measured clock offset and the offset in milliseconds.

Vault redesign

A complete Material 3 vault interface was introduced. Search covers issuer, account and folder; sorting covers A–Z, recently used, recently added and expiring soon; organization adds folder filters, folder suggestions and brand-based organization.

• Account cards with brand avatars, grouped authentication codes, circular countdown timers, one-tap copy and clipboard-clear confirmation
• Long-press actions: edit, change folder, copy code, reveal secret, export and delete
• Account editing for issuer, account, secret, folder, color and advanced parameters
• Secret masking, secret reveal warnings, explicit deletion confirmation and single-account otpauth:// export
• Empty-state onboarding, recently-used tracking and duplicate detection

TOTP and QR import

Support was added for RFC 6238 configurations: SHA-1, SHA-256 and SHA-512, 6-digit and 8-digit codes and 10–120 second periods. Strict otpauth:// parsing, friendly parser errors, Base32 validation and normalization, URI export, 3+3 and 4+4 code formatting, QR import confirmation and invalid-code handling were added. Scanner improvements cover torch control, camera switching, single-shot detection and a framing overlay.

Brand recognition

A registry containing 90+ recognized services was added. Brand recognition can provide an application icon, brand color, suggested folder and canonical service name, while unknown issuers receive a safe fallback presentation.

PC Companion dashboard

The PC dashboard was redesigned with the x2y visual identity, inline SVG branding, live search, circular countdowns, session-expiry handling, click-to-copy codes and cache-prevention headers.

Stealth Mode

A guided three-step setup was added: real PIN, stealth PIN and decoy preparation. It includes REAL VAULT and DECOY VAULT indicators, optional decoy-account seeding, sample accounts, PIN management and real-vault biometric resolution.

Settings and documentation

Settings are organized into Security Center, Appearance, Security, Recovery, Companion, Guide and About. An in-app About page, in-app changelog, How-It-Works cards and NTP status information were added.

Engineering

Major internal improvements include database schema v2, non-destructive database migration and rewrites of the backup, OTP, brand, security and biometric services, plus new clipboard, screen-security, companion, companion web and diagnostics services. Dedicated test suites were added for OTP, backups, brands and account models, alongside a native FLAG_SECURE method channel, cross-platform theme portability, an audited icon system and README/CHANGELOG documentation. No new third-party dependencies were introduced.