Monica is a local-first password manager and 2FA generator for Android, written in Kotlin and released under GPL-3.0, that aggregates Bitwarden and KeePass vaults into a single encrypted store for people who want their credentials to stay on their own devices rather than in a third-party cloud.

What it is

Monica is an Android application built around a local encrypted vault. It keeps logins, bank cards, identity information, private notes and attachments encrypted on the device, and it adds a built-in TOTP generator so that one-time codes live beside the passwords they protect. The project defines its own local-first vault format called MDBX, which is designed around nested folders, attachments, commit history, conflict detection, tombstone deletion chains, snapshot recovery and a "Tiga" security mode, with a full format specification and a client integration guide published for anyone who wants to read that database from another client. The Android client is implemented with Jetpack Compose, Material 3 and Navigation Compose on the UI side, Room with DAOs and repositories for data, Koin for dependency injection, and Kotlin Coroutines with Flow for concurrency.

The concrete problem it solves is vault fragmentation. Many people maintain a Bitwarden account and, separately, a KeePass .kdbx file, which means two clients, two unlocking flows and two places where a credential might or might not exist. Monica aggregates both ecosystems on the Android side, carrying Bitwarden API and sync capability alongside KeePass read/write support through the kotpass library, and it folds TOTP into the same application instead of leaving a second authenticator app in the loop. Cross-device movement is deliberately optional and stays under the user's control: rather than routing data through a vendor service, Monica syncs and backs up over WebDAV infrastructure the user already operates, with an AutoBackupWorker built on WorkManager handling scheduled automatic backups.

Key capabilities

• Local encrypted vault for logins, bank cards, identity records, private notes and attachments, held on-device rather than in a hosted service.
• Dual-ecosystem aggregation: Bitwarden API and sync integration through Retrofit and OkHttp, plus KeePass .kdbx reading and writing through kotpass.
• Built-in TOTP management, storing shared secrets and generating dynamic verification codes inside the same app as the passwords.
• Optional WebDAV sync and backup over the user's own infrastructure, using sardine-android and scheduled through the AutoBackupWorker.
• The MDBX local vault format, covering nested folders, attachments, commit history, conflict detection, tombstone deletion and snapshot recovery, documented in mdbx/docs with a CLIENT_INTEGRATION_GUIDE for third-party clients.
• Cryptographic design based on AES-256-GCM authenticated encryption with PBKDF2-HMAC-SHA256 key derivation at high iteration counts.
• Platform security integration through Android Keystore, EncryptedSharedPreferences and BiometricPrompt, giving biometric unlock on supported devices, alongside search by title, domain or tag.

Who uses it and how

• Android users on Android 8.0 or later who want their credential vault to remain local and who are unwilling to hand account data to a third-party cloud.
• People who already run both Bitwarden and KeePass and want one Android client that can migrate KeePass data and reach into Bitwarden-compatible storage instead of switching between two apps.
• Users who own a WebDAV server and want cross-device flow and automated backups without a vendor-operated sync backend.
• Chrome and Edge users who build the browser extension from the Monica for Browser directory, enable developer mode at chrome://extensions/, and load the resulting dist directory as an unpacked extension to get autofill alongside the phone.
• Developers integrating with the vault format, who read the MDBX workspace notes and the client integration guide before wiring another client into the database.

Getting started

Installation on Android is a download of the latest APK from the project's GitHub Releases page, followed by installation on an Android 8.0+ device and initialisation of a master password. The browser side is currently built from source: build the plugin from the Monica for Browser directory, enable developer mode in the browser's extension page, and load the dist directory as an unpacked extension; documentation lives at the project's MonicaDocs site.

How it compares

Bitwarden and KeePass are the two tools named in the project's own material, and Monica is positioned as an aggregator of them rather than a straight replacement for either: it carries Bitwarden API and sync capability and reads and writes KeePass .kdbx files, so existing vaults can be brought along rather than rebuilt. Where a hosted Bitwarden deployment handles server-side sync for the user, Monica leaves that layer to the user, offering WebDAV against infrastructure they run themselves. Both the aggregation layer and the optional sync path are under the GPL-3.0 licence that governs the project.

When to use it — and when not to

Anyone who wants sync must operate their own WebDAV endpoint, because Monica ships no server component and no bundled hosting. Known limitations are documented plainly: Paskey creation currently fails on some Xiaomi HyperOS devices, with a community module named HyperMonica suggested as a workaround, and the surrounding platform work is uneven, with the Windows client archived, the browser extension archived and its replacement still under rewrite, and the Wear client no longer receiving continuous updates. The project is maintained primarily by a single developer whose stated focus is Android feature completion, experience and stability, so anyone needing a uniform, fully released suite across desktop, mobile and browser today should look elsewhere, as should anyone unwilling to build the browser extension from source.