LockHarbor · a password manager that keeps everything on your own phone
Two things worth knowing before anything else.
1. LockHarbor has no account and no server. Nobody — including us — can reset your master password or recover your vault. Take a backup.
2. Everything in this guide is also inside the app, under Settings → Help.
The Vault tab is your home screen. Entries live in folders you create — "boat", "work", "travel" — and an entry can sit in more than one folder. Anything you have not filed shows under Unfiled.
Search works across everything regardless of folder. The filter icon beside the search box narrows to favourites or a single type, and can be used on its own without typing anything.
Tap a value to reveal it; it hides itself again after 30 seconds. Copying puts it on the clipboard and clears it after a delay you control in Settings.
The Generator tab makes random passwords or passphrases and shows an honest strength estimate. Capitalisation and separators earn no credit, because an attacker knows those patterns — only real randomness counts. You can generate straight into an entry from the password field.
A score plus seven categories you can drill into: reused passwords, weak passwords, insecure
(http://) addresses, old passwords, missing passwords, password age, and the optional
breach check.
The score is a summary, not a measurement — the lists underneath are the part you can act on. A brand-new vault shows no score at all, because a vault with nothing in it is unused rather than secure.
Off until you turn it on, because it is the only feature that uses the internet to look at your passwords. Your password is never sent — only the first five characters of a hash of it, with the comparison done on your phone. See the Privacy Policy for exactly what that request reveals.
LockHarbor can fill saved logins into other apps and websites.
Samsung Internet is not supported yet. It asks a newer part of Android that LockHarbor does not yet answer, so LockHarbor will not appear there however it is configured. Use Chrome or Firefox for now.
A quick way to tell the difference: if filling works in a normal app but never in your browser, it is the browser's own setting rather than LockHarbor.
When you tap a password field, a LockHarbor option appears above the keyboard. Tap it, unlock if the vault is closed, and pick the entry. Only entries whose saved website matches whatever is asking are offered, and the screen always shows you who asked — check it before you tap. A look-alike address gets nothing.
If a login you expect is missing, open it in the vault and add the website address; matching runs on that.
Instead of typing, you can scan:
Nothing is photographed to storage — the camera image is read and discarded, and never leaves the phone. Always check the filled fields before saving. Card and passport scanning read printed text, so some fields can come back blank or wrong; embossed (raised-number) cards are the least reliable. Middle names on a passport fill about two thirds of the time.
This is the most important page in the guide. Your vault exists on one phone. If you lose it with no backup, nobody can recover your entries.
Settings → Backup creates one encrypted file containing everything, protected by a backup passphrase you choose at the time — deliberately separate from your master password, because the file has to be able to restore onto a phone that has no vault yet. Save it somewhere that survives losing the phone. You can also set a reminder to back up weekly, fortnightly or monthly.
Restoring works either on a fresh install (from the welcome screen) or into a vault you are already using. Restoring only ever adds — it never deletes or overwrites — so restoring the same file twice creates duplicates.
Importing from another manager is under Settings → Import: Bitwarden, 1Password, LastPass, Dashlane, Keeper, Chrome, NordPass, or a generic CSV. You see a preview and a per-row report of anything that could not be read before anything touches your vault. Folders are matched by name or created; individual entries are not matched against what you already have, so importing twice creates duplicates.
There is also a plain-text export. It is not protected in any way, it asks for your master password first, and it exists for moving to another manager.
Email lockharbor@dubayaapps.com and include your phone model and what you were doing. Never include a password, a recovery key or a backup file. No genuine support request needs them, and we will never ask.