Master Password, the App that Never Stores Your Passwords

Martin Brinkmann
Feb 3, 2023
Updated • Feb 3, 2023
Google Android

Master Password is a free password manager that does not store passwords on the devices it is run on or in the cloud. The password manager uses a different system when compared to traditional password management programs, such as Bitwarden or KeePass.

Instead of saving user generated passwords in an encrypted database, it computes strong unique passwords using a single master password and the user's name. Passwords do not get saved on the device or in the cloud, but the system that Master Password uses still supports usage on multiple devices without syncing.

Master Password for Android is a port of the iOS application of the same name. The original developer of Master Password published a revised version, called Spectre, in 2021 that is backwards compatible.

How Master Password works

Master Password computes all passwords on every start using the user's selected master password and name. The method offers several advantages over traditional password managers.

One advantage is that there is no encrypted password database that may fall into the wrong hands. Other password managers store passwords in an encrypted container, which may be copied by malicious actors.

Since there is no password database, there is no need for synchronization or a cloud connection. Users just need to install the application on their other devices and use the same master password and user combination to generate the same passwords for the services that they are using. All of this happens offline, an Internet connection is not required.

The password manager generates a key from the username and master password to generate passwords for services. The service name, e.g., amazon or ghacks, is used in the computation, and a unique password is generated based on the data.

The beauty of the solution is that the user has to remember just a single master password and username. Service names are relevant as well, and most users may want to use the name of a company or domain for that

Users get a few configuration options when a new service password is generated for the first time. They add a unique name for the service and may specify the complexity of the password. The default is set to maximum security, which generates 20 character passwords that consists of letters, numbers and special characters.  Options to switch this to less secure passwords, a PIN or phrases are also provided.

Internet services may still get compromised and there is a chance that attackers may obtain user passwords. Master Password includes a site counter option, which allows users of the service to generate a new password for any of the stored services to replace the compromised one.

The application remembers the names of the services and, if added by the user, the login name. An attacker could, in theory, gain access to the app on the Android device if the right master password is entered during login. An ingenious feature of Master Password is that it accepts any other master password as well.

Master Password includes a number of convenience features. The app supports categories and notes, there is an option to import and export data, visualize password age, and to block the saving of the username that is used during sign-in.

Closing Words

Master Password uses a completely different approach to passwords. It does not store passwords but computes them using a single master password and username, and a custom name specified by the user for the service in question. The custom name is stored on the device, and import / export options allow users to transfer that data between devices or for backup purposes.

Now You: have you tried master password or a comparable app?




software image
Author Rating
5 based on 2 votes
Software Name
Master Password
Operating System
Software Category
Landing Page

Tutorials & Tips

Previous Post: «
Next Post: «


  1. Albert said on August 18, 2023 at 1:49 pm

    Thanks for the tip Martin.

    It is for these kinds of posts that I follow GHacks.

    1. Mike Williams said on August 26, 2023 at 8:55 pm

      What’s up with the generic comment, are you a bot?

  2. Tachy said on August 18, 2023 at 3:23 pm


    Where on the planet is that still in use? I was forced to give up using my RAZRV3 years ago because 2G was phased out by AT&T.

    1. arbuz said on August 20, 2023 at 5:02 pm

      Everywhere 3G has been turned off and you don’t have LTE coverage, and believe me there are many developed countries where this is the case and if it weren’t for 2G you wouldn’t even be able to make a phone call.

    2. Doc Fuddled said on August 31, 2023 at 5:55 pm

      Maybe I missed it, but I don’t believe tha term “2G” is in the article. Perhaps you are referring to “AGM G2”??

  3. Tachy said on August 18, 2023 at 3:27 pm


    Your website has gone insane.

    When I the post button I then saw my comment posted on a different article page. When I opened this article again, it is here.

    1. Martin P. said on August 31, 2023 at 4:39 pm

      @Tachy @Martin Brinkmann

      ” Your website has gone insane. ”

      Same here. Has happened several times.

      1. owl said on September 1, 2023 at 3:42 am

        @Martin P.,

        For over two weeks now,
        I’ve been seeing “Comments” posted by subscribers appearing in different, unrelated articles.
        For the time being,
        it would be better to specify the “article name and URL” at the beginning of the post.

  4. Anonymous said on August 18, 2023 at 11:17 pm

    @tachy a lot of non-phone devices with a sim in them rely on 2G, at least here in europe.
    Usually things reporting usage or errors/alarms on something remote that does not get day to day inspection in person. They are out there in vast numbers doing important work. Reliable, good range. The low datarate is no problem at all in those cases.
    3G is gone or on its last legs everywhere, but this stuff still has too much use to cancel.

    Anyhow, interesting that they would put that in. I can see the point if you suspect a hostile 2G environment (amateur eavesdroppers with laptop, ranging up to professional grade MITM fake towers while “strangely” not getting the stronger crypto voip 4G because it is being jammed, and back down to something as old ‘stingray’ devices fallen into the wrong hands).

    But does this also mean that they have handled and rolled out a fix for that nasty 4G ‘pwn by broadcast’ problem you reported earlier this year? I had 4G disabled due to that, on the off chance that some of the local criminals would buy some cheap chinese gear, download a working exploit and probe every phone in range all over town in the hope of getting into phones of the police.

  5. Andy Prough said on August 19, 2023 at 3:04 am

    >”While most may never be attacked in stingrays, it is still recommended to disable 2G cellular connections, especially since it does not have any downsides.”

    The downside would be losing connectivity. I spend a lot of time way out in the countryside where there’s often no service or almost none. My network allows 2G, and I need it sometimes. I have an option on the phone to disable 2G, I may do that when I’m in the city and I have good 5G connectivity, but not out in the country.

    I would imagine that the stingray exploits, like most of the bad things in this world, are probably things you will run into in the crowded big cities.

  6. owl said on August 21, 2023 at 3:40 am

    I stopped using it in a mobile (Wi-Fi line) environment, so I’m almost ignorant of the actual situation,
    But the recent reality in Japan makes me realize that “the infrastructure of the web is nothing more than a papier-mâché fiction”.

    It is already beyond the scope of what an individual can do.
    What we should be aware of is the reality that “governments and those in power want to control the world through the Web”, and efforts to counter (resist and prevent) such ambitions are necessary.

  7. Anonymous said on August 26, 2023 at 9:27 pm

    Why do you want people to disable the privacy features? Hmmmmm?

  8. Anonymous said on August 27, 2023 at 2:30 am

    Now You: do you plan to keep the Ads privacy features enabled?

    I’d like to tell you, but apparently if you make a post critical of Google, you get censored. * [Editor: removed, just try to bring your opinion across without attacking anyone]

  9. Tachy said on August 27, 2023 at 5:15 am


    You website is still psychotic. Comments attach to random stories.

  10. John G. said on August 28, 2023 at 2:46 pm

    @Martin please do fix the comments, it’s completely insane commenting here! :[

  11. ECJ said on August 28, 2023 at 5:37 pm


    The comments are seriously messed up on gHacks now. These comments are mixed with the article at the below URL.

    And comments on other articles are from as far back as 2010.

  12. Naimless said on August 29, 2023 at 12:57 am

    What does this article has anything to do with all the comments on this article? LOL I think this Websuite is ran by ChatGPT. every article is messed up. Some older comments from 2015 shown up in recant articles, LOL

  13. Paul Knight said on August 31, 2023 at 3:35 am

    The picture captioned “Clearing the Android Auto’s cache might resolve the issue” is from Apple Carplay ;)

  14. Anonymous said on August 31, 2023 at 9:57 pm

    How about other things that matter:
    Drop survival?
    Screen toughness?
    Degree of water and dust protection?

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.