User Guide

System Requirements

• Windows: Windows 11 (64-bit).
• Linux: 64-bit distribution with glibc 2.17 or later.
• Disk space: about 120 MB.
• Java: the runtime is bundled with the application — no separate installation needed.
• Android (optional companion app): Android 12 or later, plus a USB cable to receive exports from the desktop.

Do I Need to Install Java?

No. OneCritto ships with its own Java runtime (Java 21), included in the Windows MSI installer and in the Windows and Linux ZIP packages. The application starts with this bundled runtime: you do not need to install Java, and a Java version already installed on your computer is not used.

Which Package to Choose

• Windows — MSI installer (recommended): digitally signed, adds OneCritto to the Start menu.
• Windows — portable ZIP: no installer to run; extract and launch.
• Linux — ZIP: extract and launch the script.
• Android — OneCritto Mobile (APK): optional companion app that receives passwords exported from the desktop.

Before downloading, the site asks you to complete a CAPTCHA: it is used only to block automated abuse of the download. The website never asks for your master password.

Windows — MSI Installer

1. Double-click the downloaded .msi file (e.g. OneCritto-2.10.0.msi).
2. Follow the installation wizard.
3. Launch OneCritto from the Start menu.

Windows — Portable ZIP

1. Extract the ZIP to a folder of your choice (e.g. C:\OneCritto).
2. Double-click OneCritto.bat to launch the application.

The portable version does not run an installer, so it is also an alternative when Windows shows reputation warnings for the MSI.

Linux

1. Extract the archive: unzip OneCritto-2.10.0-linux.zip
2. Make the script executable: chmod +x OneCritto/OneCritto.sh
3. Run it: ./OneCritto/OneCritto.sh

Android — OneCritto Mobile

1. Open the downloaded .apk file on the phone.
2. The first time, Android asks you to allow installations from this source: allow it.
3. To transfer passwords, follow the pairing procedure in Mobile Export to Android.

The app is installed outside the Play Store. It has no internet permission and never asks for a OneCritto account.

Verify the Download (SHA-256)

The Download page shows the SHA-256 checksum of every package. Compute the checksum of the file you downloaded and check that it matches:

• Windows (PowerShell): Get-FileHash .\OneCritto-2.10.0.msi -Algorithm SHA256
• Linux: sha256sum OneCritto-2.10.0-linux.zip

If the two values differ, do not install the file: download it again from the official site.

Digital Signature (Windows)

The .msi installer and the executables inside it are signed with an OV (Organization Validation) Code Signing certificate issued by Actalis Code Signing CA G2, publisher Tommaso Marano (RSA / SHA-256, RFC 3161 timestamp, so the signature remains verifiable after the certificate expires).

• From Explorer: right-click the .msi → Properties → Digital Signatures → select the signature → Details → View Certificate.
• From PowerShell: Get-AuthenticodeSignature .\OneCritto-2.10.0.msi | Format-List *

Windows Security Warnings

Even with a valid signature, Windows may show a warning the first times a new certificate is seen: Microsoft SmartScreen builds reputation over time, based on the number of installs.

• "Windows protected your PC" (SmartScreen): click More info → Run anyway, after checking that the publisher is Tommaso Marano and that the SHA-256 matches.
• Browser: "this file is not commonly downloaded": choose Keep after checking the SHA-256.
• Antivirus quarantine: false positives can happen on freshly signed builds. Submit the file to your antivirus vendor for re-analysis and, if the SHA-256 matches, restore it from quarantine.

These warnings disappear as more users install the package. The portable ZIP does not require running an installer.

Build from Source

OneCritto is open source: you can inspect the code and build the same application yourself.

1. git clone https://github.com/fabio2js/onecritto.git
2. cd onecritto
3. mvn javafx:run

Create a New Vault

Create a new encrypted vault and choose a strong master password. The encryption key is derived locally using Argon2id.

Linux users: when creating a new vault, make sure the file name ends with .onecritto (e.g. myvault.onecritto). On Linux the extension is not appended automatically. Without it, the file picker filter will not show the vault when you try to open it.

Open an Existing Vault

Open an existing .onecritto file. Only entry metadata (titles, credentials, SSH connections) is decrypted into memory. Encrypted files remain as blobs on disk and are decrypted on demand when you open or export them.

Saving

Password entries are saved to the vault when you click Save. Files are encrypted and stored as soon as you add them with Add.

Backup

The vault is a single file. Copy it and store it wherever you like.

Masked & Revealed Modes

Toggle visibility at any time. Copy works even when text is masked.

Memory & Clipboard Safety

Secure buffers are wiped on lock or field change. Clipboard content is automatically cleared after 20 seconds.

Add File

Files are encrypted immediately when added to the vault.

Open File

Files are decrypted into a secure temp area (~/.onecritto/temp/) and securely wiped automatically when the application starts, when it is locked (manually with Ctrl + L or by the inactivity timeout) and when it exits. Furthermore files are securely wiped from disk when you click the Clean temp button (eraser icon, bottom-right of the Files tab).

Export File

Export files when you need manual control. Exported files are not encrypted. Make sure to delete them securely when no longer needed.

Manual Temp Folder Cleanup

The Clean temp button (eraser icon, bottom-right of the Files tab) lets you wipe the temp folder at any time. All temporary files are overwritten with random data before deletion (secure wipe). A confirmation message is shown when complete.

Tip: use this after viewing sensitive files, so they don't remain in clear-text on disk longer than necessary.

Note: files currently open by other applications may not be deleted. Close them first and retry.

Temp File Counter

A Files: N label next to the Clean temp button shows how many clear-text files are currently in the temp folder. The counter updates automatically when you open a file, make a ssh connection or wipe. When it reads Files: 0, no decrypted file remains on disk.

Entry Fields

Each entry contains: Title (required), URL, Username, Password, Notes and Category (Password / Note / Other). A real-time strength bar is shown while typing the password. Creation date and last-password-change date are tracked automatically.

Protected Fields

Username, password and notes fields use secure char[] memory buffers — never Java String. Buffers are wiped on lock or field change.

Password Generator

Generate strong passwords and copy them securely into fields. Two modes:

• Strong — configurable length (8–40), character sets (upper, lower, digits, symbols), option to avoid ambiguous characters (0/O, 1/l/I).
• Mnemonic — pronounceable syllable-based passwords (4–12 syllables), with optional digits and symbols.

Both modes display a real-time strength score powered by the same Sentinel engine.

Search & Categories

A global search field filters entries instantly by title, username, category and notes. Three built-in categories: Password, Note, Other.

Context Menu — Quick Copy

Right-click any row in the password table to copy the Password or Username to the system clipboard. A 20-second countdown appears in the top-left corner, changing colour as time runs out (cyan > 10 s, orange ≤ 10 s, red ≤ 5 s). When the timer expires the clipboard is cleared automatically. The copy uses the same secure char[] pattern as SecureTextField.

Health Badge

After opening your vault, a health badge appears in the toolbar showing a score from 0 to 100. The color reflects your vault's security level — from green (excellent) to red (critical action needed).

Sentinel Dashboard

Click the badge to open the full dashboard. It displays the overall health score, a colored progress bar, and six summary counters: Critical, Weak, Fair, Good, Strong, and Duplicates.

Password Scoring

Each password is evaluated on a 0–100 scale based on entropy, length, character variety, and common password detection. Leet-speak variants (e.g. p@$$w0rd), keyboard patterns, repetitions, and duplicates are penalized.

Rotation Plan

A prioritized table lists entries that need attention — from common or critically weak passwords to duplicates and passwords older than 90 days. Each row shows the entry title and the reason for rotation.

Strength Column

The password table includes a Strength column with a colored progress bar — giving you an instant visual overview. Empty password entries are shown as “Empty” and excluded from analysis.

Password Coach

Select an entry and open the Password Coach for personalised tips sorted by severity:

• Critical — common password, duplicate, found in breaches, no password set.
• Warning — keyboard pattern, repetitions, low entropy, password older than 365 days.
• Info — password age > 90 days, offline crack-time estimate, improvement suggestions.
• OK — no issues detected.

The coach also shows the numeric score, a coloured strength bar and an estimated crack time.

Real-Time Updates

Sentinel automatically re-analyzes your vault whenever you open, add, edit, or delete entries. The password generator uses the same scoring engine for full consistency.

How It Works

Breach Control queries the Have I Been Pwned database using the k-anonymity protocol. Only the first 5 characters of the SHA-1 hash are sent — your actual password never leaves your device.

Full Vault Scan

Launch a scan of every entry in your vault with a single click. A progress bar tracks the operation in real time.

Clear Results

Each entry is marked with a colored icon: safe (no breach found), exposed (with the number of known breaches), or error (network issue). A summary at the end shows the overall status of your vault.

Session Cache

Results are cached during the current session to avoid repeated network requests when you re-scan.

Prerequisite

Before creating an SSH connection, add your private SSH key (e.g. id_rsa, id_ed25519 or a .pem file) as an encrypted file in the vault via File → Add.

Create a Connection

Open the SSH tab and click Add. Fill in: Connection name, Host, Port (default 22), Username, and select the SSH Key from the drop-down (lists keys already stored in the vault). A live preview shows the SSH command that will be executed. Click Save.

Edit or Delete

Double-click a row or use the Edit button to modify a connection. Use Delete to remove it (with confirmation).

Connect

Select a connection and click Connect. OneCritto automatically: decrypts the private key into a protected temporary file, sets restrictive file permissions (required by SSH), opens your system terminal with the full SSH command, and starts the session. The terminal launches ready to use.

Security

The private key is decrypted only at connection time into ~/.onecritto/temp/. The temporary file is overwritten with random data and deleted when OneCritto opens, is locked or closes, or when the Wipe temp button is pressed (secure delete). The key is never stored in plaintext permanently. SSH connections are saved inside the .onecritto vault, protected by the same AES-256-GCM encryption and Argon2id key derivation.

Automatic Recognition & Smart Matching

OneCritto recognizes CSV exports from 10 platforms: Chrome / Edge, Firefox, Safari, Bitwarden, KeePass, LastPass, 1Password, Dashlane, NordPass and Proton Pass. Fields are mapped automatically with high confidence.

For unknown formats, a 3-level algorithm identifies columns via synonym matching, Jaro-Winkler similarity and heuristic value analysis (URLs, emails, high-entropy strings).

Preview & Control

A two-panel preview shows the proposed column mapping with confidence indicators and the list of entries ready for import. Every column can be reassigned manually; each entry can be included or excluded individually. The preview updates in real time.

How to Use

1. Export passwords from your current manager in CSV format.
2. Click Import in the OneCritto toolbar.
3. Select the file — the source is detected automatically.
4. Verify the mapping and choose which entries to import.
5. Click Import — done.

The CSV is processed entirely on your device. After import, Sentinel evaluates every new password and updates the Vault Health Score. Imported entries are encrypted with AES-256-GCM / Argon2id like all others.

Requirements

• Desktop: OneCritto 2.10.0 (Windows or Linux).
• Phone: OneCritto Mobile 1.0.1 on Android 12 (API 31) or later — required to keep the private key inside the security chip.
• Connection: a USB cable, with the phone set to File transfer mode.
• Network: none. The Android app does not request the internet permission.

Note: automatic phone detection works on Windows and Linux. macOS does not speak the MTP protocol, so there only the manual mode is available (pasting the pairing code by hand).

Step 1 — Pair your phone (once)

1. In the Android app, generate and export the pairing key.
2. Connect the phone to the computer with the USB cable, in File transfer mode.
3. On the desktop, click Pair mobile device. The computer finds the phone and reads the key on its own — no file hunting, no copying.
4. Both apps display the same 8-digit code. Check that they match, then confirm.

No configuration files, no QR code to frame, no long codes to type. Plug in the cable, press a button, compare 8 digits.

Step 2 — Export your passwords

1. On the desktop, click the mobile export button and pick the entries to send.
2. Save the encrypted file (extension .onecritto-vault) and copy it to the phone over the cable.
3. In the Android app, import the file — the entries appear in the phone's vault.

Repeat this step whenever you need to; pairing is not required again.

Why the 8-digit code matters

Comparing the code on both screens is what stops an attacker from silently swapping the phone's key for their own. It takes two seconds and it is not optional — if the two codes differ, cancel the pairing.

The code is a fingerprint derived from the SHA-256 of the public key, the same principle as Bluetooth numeric comparison.

What is exported — and what is not

Exported: password entries — title, username, site address, notes and password.

Not exported: encrypted files stored in the vault and SSH connections. Those stay on the computer only.

This is a one-way, manual export (computer → phone). It is not a sync, it is not automatic, and it does not replace a backup of your vault.

One phone per vault

A vault is paired with one phone at a time. Pairing a different phone replaces the previous one — the app asks for explicit confirmation before doing so.

Exports already transferred remain readable on the phone that received them.

How the file is protected

• The secret never travels. During pairing the phone shares only a public key — useless to anyone who intercepts it. The key that opens the data is generated inside the Android security chip and cannot be extracted from it.
• Every export gets a throwaway key. Even if one exported file were compromised, it would not open earlier or later ones (forward secrecy).
• Sealed for a single phone. An export addressed to your phone cannot be opened on any other device, including by someone who intercepts it during the copy.
• Standard cryptography. HPKE (RFC 9180), a public IETF standard, with the same AES-256-GCM encryption already used by the desktop vault.

Technical details

• Scheme: HPKE (RFC 9180), base mode, sealed-box.
• Suite: DHKEM(P-256, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM.
• Recipient key: a P-256 EC pair generated in the Android Keystore with PURPOSE_AGREE_KEY, non-exportable; the ECDH computation happens inside the Keystore (requires Android 12 / API 31).
• Sender key: ephemeral, regenerated for every export.
• Recipient authentication: the AEAD tag fails if the file is not addressed to that phone or has been tampered with.
• Pairing data: stored inside the encrypted vault, protected by the same HMAC that guarantees its integrity.