diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4891bf0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,18 @@
+name: CI
+on:
+  push:
+    branches: [versionF]
+  pull_request:
+    branches: [versionF]
+
+jobs:
+  analyze-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+      - run: flutter pub get
+      - run: flutter analyze
+      - run: flutter test
diff --git a/analysis_options.yaml b/analysis_options.yaml
index 0d29021..0ba2ecd 100644
--- a/analysis_options.yaml
+++ b/analysis_options.yaml
@@ -9,20 +9,10 @@
 # packages, and plugins designed to encourage good coding practices.
 include: package:flutter_lints/flutter.yaml
 
+analyzer:
+  exclude:
+    - "lib/examples/**"
+
 linter:
-  # The lint rules applied to this project can be customized in the
-  # section below to disable rules from the `package:flutter_lints/flutter.yaml`
-  # included above or to enable additional rules. A list of all available lints
-  # and their documentation is published at https://dart.dev/lints.
-  #
-  # Instead of disabling a lint rule for the entire project in the
-  # section below, it can also be suppressed for a single line of code
-  # or a specific dart file by using the `// ignore: name_of_lint` and
-  # `// ignore_for_file: name_of_lint` syntax on the line or in the file
-  # producing the lint.
   rules:
-    # avoid_print: false  # Uncomment to disable the `avoid_print` rule
-    # prefer_single_quotes: true  # Uncomment to enable the `prefer_single_quotes` rule
-
-# Additional information about this file can be found at
-# https://dart.dev/guides/language/analysis-options
+    avoid_print: true
diff --git a/android/app/build.gradle b/android/app/build.gradle
index 4d407ad..80469ca 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -47,7 +47,6 @@ android {
     }
 
     defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId = "com.mossapps.locker"
         // You can update the following values to match your application needs.
         // For more information, see: https://docs.flutter.dev/deployment/android#reviewing-the-gradle-build-configuration.
@@ -69,6 +68,9 @@ android {
     buildTypes {
         release {
             signingConfig = signingConfigs.release
+            minifyEnabled true
+            shrinkResources true
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
         }
     }
 }
diff --git a/android/app/proguard-rules.pro b/android/app/proguard-rules.pro
new file mode 100644
index 0000000..a1c74b5
--- /dev/null
+++ b/android/app/proguard-rules.pro
@@ -0,0 +1,12 @@
+# Flutter
+-keep class io.flutter.** { *; }
+-keep class io.flutter.plugins.** { *; }
+-dontwarn io.flutter.embedding.**
+
+# pointycastle (crypto)
+-keep class org.bouncycastle.** { *; }
+-dontwarn org.bouncycastle.**
+
+# Autofill service
+-keep class com.mossapps.locker.AutofillService { *; }
+-keep class com.mossapps.locker.AutofillSelectionActivity { *; }
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index b4e19ca..c91c0b7 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -29,7 +29,10 @@
         android:label="Latch"
         android:name="${applicationName}"
         android:icon="@mipmap/launcher_icon"
-        android:requestLegacyExternalStorage="true">
+        android:requestLegacyExternalStorage="true"
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:networkSecurityConfig="@xml/network_security_config">
 
         <activity
             android:name=".MainActivity"
@@ -78,6 +81,27 @@
             android:name="flutterEmbedding"
             android:value="2" />
 
+        <service
+            android:name=".AutofillService"
+            android:label="Latch"
+            android:exported="true"
+            android:permission="android.permission.BIND_AUTOFILL_SERVICE">
+            <intent-filter>
+                <action android:name="android.service.autofill.AutofillService" />
+            </intent-filter>
+            <meta-data
+                android:name="android.autofill"
+                android:resource="@xml/autofill_service" />
+        </service>
+
+        <activity
+            android:name=".AutofillSelectionActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:theme="@style/NormalTheme"
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
+            android:windowSoftInputMode="adjustResize" />
+
     </application>
 
     <!-- Required to query activities that can process text, see:
diff --git a/android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt b/android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt
new file mode 100644
index 0000000..81c2f08
--- /dev/null
+++ b/android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt
@@ -0,0 +1,31 @@
+package com.mossapps.locker
+
+import android.app.assist.AssistStructure
+import android.service.autofill.FillCallback
+import android.view.autofill.AutofillId
+
+enum class FieldType { USERNAME, PASSWORD }
+
+data class AutofillField(val autofillId: AutofillId, val type: FieldType)
+
+object AutofillCallbackHolder {
+    var callback: FillCallback? = null
+        private set
+    var fields: List<AutofillField>? = null
+        private set
+
+    fun set(callback: FillCallback, fields: List<AutofillField>) {
+        this.callback = callback
+        this.fields = fields
+    }
+
+    fun cancel() {
+        try { callback?.onSuccess(null) } catch (_: Exception) {}
+        clear()
+    }
+
+    fun clear() {
+        callback = null
+        fields = null
+    }
+}
diff --git a/android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt b/android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt
new file mode 100644
index 0000000..343574f
--- /dev/null
+++ b/android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt
@@ -0,0 +1,108 @@
+package com.mossapps.locker
+
+import android.app.assist.AssistStructure
+import android.os.Build
+import android.os.Bundle
+import android.service.autofill.Dataset
+import android.service.autofill.FillResponse
+import android.util.Log
+import android.view.View
+import android.view.WindowManager
+import android.view.autofill.AutofillValue
+import android.widget.RemoteViews
+import androidx.annotation.RequiresApi
+import io.flutter.embedding.android.FlutterFragmentActivity
+import io.flutter.embedding.engine.FlutterEngine
+import io.flutter.plugin.common.MethodChannel
+
+@RequiresApi(Build.VERSION_CODES.O)
+class AutofillSelectionActivity : FlutterFragmentActivity() {
+
+    private val CHANNEL = "com.mossapps.locker/autofill"
+
+    override fun getDartEntrypointFunctionName(): String = "autofillMain"
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        window.setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE)
+    }
+
+    override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
+        super.configureFlutterEngine(flutterEngine)
+        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, CHANNEL).setMethodCallHandler { call, result ->
+            when (call.method) {
+                "fillCredentials" -> {
+                    val username = call.argument<String>("username") ?: ""
+                    val password = call.argument<String>("password") ?: ""
+                    val title = call.argument<String>("title") ?: "Latch"
+                    fillCredentials(username, password, title, result)
+                }
+                "cancel" -> {
+                    AutofillCallbackHolder.cancel()
+                    result.success(null)
+                    finish()
+                }
+                else -> result.notImplemented()
+            }
+        }
+    }
+
+    private fun fillCredentials(username: String, password: String, title: String, result: MethodChannel.Result) {
+        val callback = AutofillCallbackHolder.callback
+        val fields = AutofillCallbackHolder.fields
+
+        if (callback == null || fields == null) {
+            result.error("no_callback", "No fill request pending", null)
+            finish()
+            return
+        }
+
+        try {
+            val presentation = RemoteViews(packageName, R.layout.autofill_suggestion)
+            presentation.setTextViewText(R.id.autofill_title, title)
+
+            val builder = Dataset.Builder()
+            var matched = false
+
+            for (field in fields) {
+                when (field.type) {
+                    FieldType.USERNAME -> {
+                        if (username.isNotEmpty()) {
+                            builder.setValue(field.autofillId, AutofillValue.forText(username), presentation)
+                            matched = true
+                        }
+                    }
+                    FieldType.PASSWORD -> {
+                        if (password.isNotEmpty()) {
+                            builder.setValue(field.autofillId, AutofillValue.forText(password), presentation)
+                            matched = true
+                        }
+                    }
+                }
+            }
+
+            if (!matched) {
+                AutofillCallbackHolder.cancel()
+                result.success(null)
+                finish()
+                return
+            }
+
+            val response = FillResponse.Builder().addDataset(builder.build()).build()
+            callback.onSuccess(response)
+            AutofillCallbackHolder.clear()
+            result.success(null)
+            finish()
+        } catch (e: Exception) {
+            Log.e("AutofillSelection", "fill failed", e)
+            AutofillCallbackHolder.cancel()
+            result.error("fill_error", e.message, null)
+            finish()
+        }
+    }
+
+    override fun onDestroy() {
+        AutofillCallbackHolder.cancel()
+        super.onDestroy()
+    }
+}
diff --git a/android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt b/android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt
new file mode 100644
index 0000000..f0ddfa6
--- /dev/null
+++ b/android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt
@@ -0,0 +1,92 @@
+package com.mossapps.locker
+
+import android.app.assist.AssistStructure
+import android.content.Intent
+import android.os.Build
+import android.os.CancellationSignal
+import android.service.autofill.AutofillService
+import android.service.autofill.FillCallback
+import android.service.autofill.FillRequest
+import android.service.autofill.FillResponse
+import android.service.autofill.SaveRequest
+import android.text.InputType
+import android.view.View
+import android.view.autofill.AutofillId
+import androidx.annotation.RequiresApi
+
+@RequiresApi(Build.VERSION_CODES.O)
+class AutofillService : AutofillService() {
+
+    override fun onFillRequest(request: FillRequest, cancellationSignal: CancellationSignal, callback: FillCallback) {
+        val structure = request.fillContexts.lastOrNull()?.structure
+        if (structure == null) {
+            callback.onSuccess(null)
+            return
+        }
+
+        val fields = parseFields(structure)
+        if (fields.isEmpty()) {
+            callback.onSuccess(null)
+            return
+        }
+
+        AutofillCallbackHolder.set(callback, fields)
+
+        val intent = Intent(this, AutofillSelectionActivity::class.java).apply {
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK
+        }
+        startActivity(intent)
+    }
+
+    override fun onSaveRequest(request: SaveRequest, callback: android.service.autofill.SaveCallback) {
+        callback.onSuccess()
+    }
+
+    private fun parseFields(structure: AssistStructure): List<AutofillField> {
+        val fields = mutableListOf<AutofillField>()
+        val seenIds = mutableSetOf<AutofillId>()
+
+        for (i in 0 until structure.windowNodeCount) {
+            traverseNode(structure.getWindowNodeAt(i).rootViewNode, fields, seenIds)
+        }
+        return fields
+    }
+
+    private fun traverseNode(node: AssistStructure.ViewNode, fields: MutableList<AutofillField>, seenIds: MutableSet<AutofillId>) {
+        val id = node.autofillId
+        if (id != null && id !in seenIds) {
+            val type = classifyField(node)
+            if (type != null) {
+                fields.add(AutofillField(id, type))
+                seenIds.add(id)
+            }
+        }
+
+        for (i in 0 until node.childCount) {
+            traverseNode(node.getChildAt(i), fields, seenIds)
+        }
+    }
+
+    private fun classifyField(node: AssistStructure.ViewNode): FieldType? {
+        val hints = node.autofillHints
+        if (hints != null) {
+            for (hint in hints) {
+                when (hint) {
+                    View.AUTOFILL_HINT_USERNAME, View.AUTOFILL_HINT_EMAIL_ADDRESS -> return FieldType.USERNAME
+                    View.AUTOFILL_HINT_PASSWORD -> return FieldType.PASSWORD
+                }
+            }
+        }
+
+        val inputType = node.inputType
+        val variation = inputType and InputType.TYPE_MASK_VARIATION
+        when (variation) {
+            InputType.TYPE_TEXT_VARIATION_PASSWORD,
+            InputType.TYPE_TEXT_VARIATION_VISIBLE_PASSWORD,
+            InputType.TYPE_NUMBER_VARIATION_PASSWORD -> return FieldType.PASSWORD
+            InputType.TYPE_TEXT_VARIATION_EMAIL_ADDRESS -> return FieldType.USERNAME
+        }
+
+        return null
+    }
+}
diff --git a/android/app/src/main/res/layout/autofill_suggestion.xml b/android/app/src/main/res/layout/autofill_suggestion.xml
new file mode 100644
index 0000000..baa8436
--- /dev/null
+++ b/android/app/src/main/res/layout/autofill_suggestion.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="wrap_content"
+    android:orientation="horizontal"
+    android:padding="12dp"
+    android:gravity="center_vertical">
+
+    <ImageView
+        android:layout_width="24dp"
+        android:layout_height="24dp"
+        android:src="@mipmap/launcher_icon"
+        android:layout_marginEnd="12dp" />
+
+    <TextView
+        android:id="@+id/autofill_title"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:textSize="16sp"
+        android:textColor="#FFFFFF"
+        android:singleLine="true"
+        android:ellipsize="end" />
+</LinearLayout>
diff --git a/android/app/src/main/res/xml/autofill_service.xml b/android/app/src/main/res/xml/autofill_service.xml
new file mode 100644
index 0000000..56f208e
--- /dev/null
+++ b/android/app/src/main/res/xml/autofill_service.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<autofill-service xmlns:android="http://schemas.android.com/apk/res/android"
+    android:settingsActivity="com.mossapps.locker.MainActivity" />
diff --git a/android/app/src/main/res/xml/data_extraction_rules.xml b/android/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 0000000..81adda5
--- /dev/null
+++ b/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="sharedpref" />
+        <exclude domain="file" />
+        <exclude domain="database" />
+        <exclude domain="root" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="sharedpref" />
+        <exclude domain="file" />
+        <exclude domain="database" />
+        <exclude domain="root" />
+    </device-transfer>
+</data-extraction-rules>
diff --git a/android/app/src/main/res/xml/network_security_config.xml b/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..683208f
--- /dev/null
+++ b/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>
diff --git a/lib/autofill_app.dart b/lib/autofill_app.dart
new file mode 100644
index 0000000..f77a517
--- /dev/null
+++ b/lib/autofill_app.dart
@@ -0,0 +1,18 @@
+import 'package:flutter/material.dart';
+import 'models/accent_color.dart';
+import 'screens/autofill_selection_screen.dart';
+import 'themes/app_theme.dart';
+
+class AutofillApp extends StatelessWidget {
+  const AutofillApp({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      title: 'Latch',
+      debugShowCheckedModeBanner: false,
+      theme: AppTheme.getDarkTheme(AccentColors.blue),
+      home: const AutofillSelectionScreen(),
+    );
+  }
+}
diff --git a/lib/examples/compression_usage_example.dart b/lib/examples/compression_usage_example.dart
deleted file mode 100644
index 36008bb..0000000
--- a/lib/examples/compression_usage_example.dart
+++ /dev/null
@@ -1,262 +0,0 @@
-import 'package:flutter/material.dart';
-import '../services/media_compression_service.dart';
-import '../utils/compression_helper.dart';
-import '../widgets/compression_options_dialog.dart';
-
-/// Example showing how to use compression features
-class CompressionUsageExample extends StatefulWidget {
-  const CompressionUsageExample({super.key});
-
-  @override
-  State<CompressionUsageExample> createState() => _CompressionUsageExampleState();
-}
-
-class _CompressionUsageExampleState extends State<CompressionUsageExample> {
-  String _statusMessage = '';
-  double _compressionProgress = 0.0;
-
-  @override
-  Widget build(BuildContext context) {
-    return Scaffold(
-      appBar: AppBar(
-        title: Text('Compression Examples'),
-      ),
-      body: Padding(
-        padding: EdgeInsets.all(16),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.stretch,
-          children: [
-            Text(
-              'Media Compression Options',
-              style: Theme.of(context).textTheme.headlineSmall,
-            ),
-            SizedBox(height: 16),
-            
-            // Status message
-            if (_statusMessage.isNotEmpty)
-              Card(
-                child: Padding(
-                  padding: EdgeInsets.all(12),
-                  child: Text(_statusMessage),
-                ),
-              ),
-            
-            // Progress indicator
-            if (_compressionProgress > 0)
-              LinearProgressIndicator(value: _compressionProgress),
-            
-            SizedBox(height: 24),
-            
-            // Example buttons
-            ElevatedButton(
-              onPressed: _exampleCompressImage,
-              child: Text('Example: Compress Image'),
-            ),
-            SizedBox(height: 8),
-            ElevatedButton(
-              onPressed: _exampleCompressVideo,
-              child: Text('Example: Compress Video'),
-            ),
-            SizedBox(height: 8),
-            ElevatedButton(
-              onPressed: _exampleShowCompressionDialog,
-              child: Text('Example: Show Compression Dialog'),
-            ),
-            SizedBox(height: 24),
-            
-            // Usage instructions
-            Expanded(
-              child: SingleChildScrollView(
-                child: Card(
-                  child: Padding(
-                    padding: EdgeInsets.all(16),
-                    child: Column(
-                      crossAxisAlignment: CrossAxisAlignment.start,
-                      children: [
-                        Text(
-                          'Usage Instructions',
-                          style: TextStyle(
-                            fontSize: 18,
-                            fontWeight: FontWeight.bold,
-                          ),
-                        ),
-                        SizedBox(height: 12),
-                        _buildUsageSection(),
-                      ],
-                    ),
-                  ),
-                ),
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-
-  Widget _buildUsageSection() {
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.start,
-      children: [
-        Text(
-          '1. Basic Image Compression:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-final result = await MediaCompressionService.instance.compressImage(
-  sourcePath: '/path/to/image.jpg',
-  quality: 70,  // 0-100
-  maxWidth: 1920,
-  maxHeight: 1920,
-);
-
-if (result != null) {
-  print('Compressed: \${result.formattedOriginalSize} → \${result.formattedCompressedSize}');
-  print('Saved: \${result.formattedRatio}');
-  // Use result.compressedPath
-}
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          '2. Basic Video Compression:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-final result = await MediaCompressionService.instance.compressVideo(
-  sourcePath: '/path/to/video.mp4',
-  quality: VideoQuality.DefaultQuality,
-  onProgress: (progress) {
-    print('Progress: \${progress.toStringAsFixed(1)}%');
-  },
-);
-
-if (result != null) {
-  print('Compressed: \${result.formattedOriginalSize} → \${result.formattedCompressedSize}');
-  // Use result.compressedPath
-}
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          '3. Using Compression Dialog:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-// Show dialog to user
-final option = await CompressionHelper.showCompressionDialog(
-  context,
-  isVideo: false,
-);
-
-if (option != null) {
-  // Compress based on user selection
-  final compressedPath = await CompressionHelper.compressImageIfNeeded(
-    sourcePath: imagePath,
-    option: option,
-    onStatusUpdate: (message) => print(message),
-  );
-  
-  // Use compressedPath for import
-}
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          '4. Batch Compression:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-final compressedPaths = await CompressionHelper.compressImagesIfNeeded(
-  sourcePaths: ['/path/1.jpg', '/path/2.jpg'],
-  option: CompressionOption.medium,
-  onProgress: (current, total) {
-    print('Compressing \$current/\$total');
-  },
-);
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          'Quality Levels:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text('• None: Original quality (100%)'),
-        Text('• Low: High quality (85%)'),
-        Text('• Medium: Balanced (70%)'),
-        Text('• High: Maximum compression (50%)'),
-      ],
-    );
-  }
-
-  Future<void> _exampleCompressImage() async {
-    setState(() {
-      _statusMessage = 'This would compress an image file...';
-      _compressionProgress = 0.0;
-    });
-
-    // In real usage, you would have an actual image path
-    // final result = await MediaCompressionService.instance.compressImage(
-    //   sourcePath: imagePath,
-    //   quality: 70,
-    // );
-    
-    await Future.delayed(Duration(seconds: 2));
-    
-    setState(() {
-      _statusMessage = 'Example: Image compressed from 5.2 MB → 1.8 MB (65% saved)';
-      _compressionProgress = 1.0;
-    });
-  }
-
-  Future<void> _exampleCompressVideo() async {
-    setState(() {
-      _statusMessage = 'This would compress a video file...';
-      _compressionProgress = 0.0;
-    });
-
-    // Simulate progress
-    for (int i = 0; i <= 100; i += 10) {
-      await Future.delayed(Duration(milliseconds: 200));
-      setState(() {
-        _compressionProgress = i / 100;
-        _statusMessage = 'Compressing video: ${i}%';
-      });
-    }
-    
-    setState(() {
-      _statusMessage = 'Example: Video compressed from 45.3 MB → 12.7 MB (72% saved)';
-    });
-  }
-
-  Future<void> _exampleShowCompressionDialog() async {
-    final option = await CompressionHelper.showCompressionDialog(
-      context,
-      isVideo: false,
-    );
-
-    if (option != null) {
-      setState(() {
-        _statusMessage = 'Selected: ${option.name} (Quality: ${option.imageQuality}%)';
-        _compressionProgress = 0.0;
-      });
-    }
-  }
-}
diff --git a/lib/main.dart b/lib/main.dart
index b2e517e..fd1df91 100644
--- a/lib/main.dart
+++ b/lib/main.dart
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -12,11 +14,11 @@ import 'providers/vault_providers.dart';
 import 'services/auth_service.dart';
 import 'screens/auth_method_selection_screen.dart';
 import 'screens/unlock_screen.dart';
+import 'autofill_app.dart';
 import 'utils/frame_rate_optimizer.dart';
+import 'utils/navigator_key.dart';
 import 'utils/performance_config.dart';
 
-final GlobalKey<NavigatorState> navigatorKey = GlobalKey<NavigatorState>();
-
 Future<void> main() async {
   WidgetsFlutterBinding.ensureInitialized();
 
@@ -72,6 +74,7 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
   final AuthService _authService = AuthService();
   bool _isLoading = true;
   bool _isFirstTime = true;
+  StreamSubscription<AppUpdateInfo?>? _updateSub;
 
   @override
   void initState() {
@@ -79,7 +82,7 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
     _checkAuthStatus();
 
     final updateService = ref.read(updateServiceProvider);
-    updateService.onUpdateCheck.listen((info) {
+    _updateSub = updateService.onUpdateCheck.listen((info) {
       if (info != null &&
           info.updateAvailability == UpdateAvailability.updateAvailable) {
         _showUpdateDialog();
@@ -87,6 +90,12 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
     });
   }
 
+  @override
+  void dispose() {
+    _updateSub?.cancel();
+    super.dispose();
+  }
+
   void _showUpdateDialog() {
     final context = navigatorKey.currentContext;
     if (context == null) return;
@@ -150,3 +159,6 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
     }
   }
 }
+
+@pragma('vm:entry-point')
+void autofillMain() => runApp(AutofillApp());
diff --git a/lib/models/password_entry.dart b/lib/models/password_entry.dart
new file mode 100644
index 0000000..9f4ed1e
--- /dev/null
+++ b/lib/models/password_entry.dart
@@ -0,0 +1,194 @@
+import 'dart:convert';
+
+import 'encryption_algorithm.dart';
+
+class PasswordContent {
+  final String username;
+  final String password;
+  final String url;
+  final String notes;
+
+  const PasswordContent({
+    this.username = '',
+    this.password = '',
+    this.url = '',
+    this.notes = '',
+  });
+
+  PasswordContent copyWith({
+    String? username,
+    String? password,
+    String? url,
+    String? notes,
+  }) {
+    return PasswordContent(
+      username: username ?? this.username,
+      password: password ?? this.password,
+      url: url ?? this.url,
+      notes: notes ?? this.notes,
+    );
+  }
+
+  Map<String, dynamic> toJson() {
+    return {
+      'username': username,
+      'password': password,
+      'url': url,
+      'notes': notes,
+    };
+  }
+
+  factory PasswordContent.fromJson(Map<String, dynamic> json) {
+    return PasswordContent(
+      username: json['username'] as String? ?? '',
+      password: json['password'] as String? ?? '',
+      url: json['url'] as String? ?? '',
+      notes: json['notes'] as String? ?? '',
+    );
+  }
+
+  String toJsonString() => jsonEncode(toJson());
+
+  factory PasswordContent.fromJsonString(String jsonString) {
+    return PasswordContent.fromJson(jsonDecode(jsonString) as Map<String, dynamic>);
+  }
+}
+
+class PasswordEntry {
+  final String id;
+  final String title;
+  final String encryptedContentPath;
+  final String iv;
+  final String keyDerivationSalt;
+  final int kdfIterations;
+  final List<String> tags;
+  final bool isFavorite;
+  final bool isEncrypted;
+  final EncryptionAlgorithm encryptionAlgorithm;
+  final DateTime createdAt;
+  final DateTime updatedAt;
+
+  const PasswordEntry({
+    required this.id,
+    required this.title,
+    required this.encryptedContentPath,
+    required this.iv,
+    required this.keyDerivationSalt,
+    this.kdfIterations = 100000,
+    this.tags = const [],
+    this.isFavorite = false,
+    this.isEncrypted = false,
+    this.encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    required this.createdAt,
+    required this.updatedAt,
+  });
+
+  PasswordEntry copyWith({
+    String? id,
+    String? title,
+    String? encryptedContentPath,
+    String? iv,
+    String? keyDerivationSalt,
+    int? kdfIterations,
+    List<String>? tags,
+    bool? isFavorite,
+    bool? isEncrypted,
+    EncryptionAlgorithm? encryptionAlgorithm,
+    DateTime? createdAt,
+    DateTime? updatedAt,
+  }) {
+    return PasswordEntry(
+      id: id ?? this.id,
+      title: title ?? this.title,
+      encryptedContentPath: encryptedContentPath ?? this.encryptedContentPath,
+      iv: iv ?? this.iv,
+      keyDerivationSalt: keyDerivationSalt ?? this.keyDerivationSalt,
+      kdfIterations: kdfIterations ?? this.kdfIterations,
+      tags: tags ?? this.tags,
+      isFavorite: isFavorite ?? this.isFavorite,
+      isEncrypted: isEncrypted ?? this.isEncrypted,
+      encryptionAlgorithm: encryptionAlgorithm ?? this.encryptionAlgorithm,
+      createdAt: createdAt ?? this.createdAt,
+      updatedAt: updatedAt ?? this.updatedAt,
+    );
+  }
+
+  PasswordEntry toggleFavorite() =>
+      copyWith(isFavorite: !isFavorite, updatedAt: DateTime.now());
+
+  PasswordEntry addTag(String tag) {
+    final normalized = tag.toLowerCase().trim();
+    if (normalized.isEmpty || tags.contains(normalized)) return this;
+    return copyWith(tags: [...tags, normalized]);
+  }
+
+  PasswordEntry removeTag(String tag) {
+    final normalized = tag.toLowerCase().trim();
+    if (!tags.contains(normalized)) return this;
+    return copyWith(tags: tags.where((t) => t != normalized).toList());
+  }
+
+  bool hasTag(String tag) => tags.contains(tag.toLowerCase().trim());
+
+  Map<String, dynamic> toJson() {
+    return {
+      'id': id,
+      'title': title,
+      'encryptedContentPath': encryptedContentPath,
+      'iv': iv,
+      'keyDerivationSalt': keyDerivationSalt,
+      'kdfIterations': kdfIterations,
+      'tags': tags,
+      'isFavorite': isFavorite,
+      'isEncrypted': isEncrypted,
+      'encryptionAlgorithm': encryptionAlgorithm.name,
+      'createdAt': createdAt.toIso8601String(),
+      'updatedAt': updatedAt.toIso8601String(),
+    };
+  }
+
+  factory PasswordEntry.fromJson(Map<String, dynamic> json) {
+    return PasswordEntry(
+      id: json['id'] as String,
+      title: json['title'] as String,
+      encryptedContentPath: json['encryptedContentPath'] as String,
+      iv: json['iv'] as String,
+      keyDerivationSalt: json['keyDerivationSalt'] as String,
+      kdfIterations: json['kdfIterations'] as int? ?? 100000,
+      tags: (json['tags'] as List<dynamic>?)
+              ?.map((e) => e as String)
+              .toList() ??
+          const [],
+      isFavorite: json['isFavorite'] as bool? ?? false,
+      isEncrypted: json['isEncrypted'] as bool? ?? false,
+      encryptionAlgorithm: json['encryptionAlgorithm'] != null
+          ? EncryptionAlgorithm.values.firstWhere(
+              (e) => e.name == json['encryptionAlgorithm'],
+              orElse: () => EncryptionAlgorithm.aes256Gcm,
+            )
+          : EncryptionAlgorithm.aes256Gcm,
+      createdAt: DateTime.parse(json['createdAt'] as String),
+      updatedAt: DateTime.parse(json['updatedAt'] as String),
+    );
+  }
+
+  String toJsonString() => jsonEncode(toJson());
+
+  factory PasswordEntry.fromJsonString(String jsonString) {
+    return PasswordEntry.fromJson(jsonDecode(jsonString) as Map<String, dynamic>);
+  }
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      other is PasswordEntry &&
+          runtimeType == other.runtimeType &&
+          id == other.id;
+
+  @override
+  int get hashCode => id.hashCode;
+
+  @override
+  String toString() =>
+      'PasswordEntry(id: $id, title: $title, favorite: $isFavorite)';
+}
diff --git a/lib/providers/explorer_providers.dart b/lib/providers/explorer_providers.dart
index 51a0953..74677e5 100644
--- a/lib/providers/explorer_providers.dart
+++ b/lib/providers/explorer_providers.dart
@@ -36,7 +36,9 @@ final explorerFileTypeFilterProvider = StateProvider<VaultedFileType?>((ref) {
 
 /// Provider for unfiled files (files that do not belong to any folder)
 final unfiledFilesProvider = FutureProvider<List<VaultedFile>>((ref) async {
-  final allFiles = await ref.watch(allFilesProvider.future);
+  final vaultService = ref.watch(vaultServiceProvider);
+  final isDecoy = ref.watch(isDecoyModeProvider);
+  final allFiles = await vaultService.getAllFiles(isDecoy: isDecoy);
   return allFiles.where((file) => file.folderId == null).toList();
 });
 
diff --git a/lib/providers/password_providers.dart b/lib/providers/password_providers.dart
new file mode 100644
index 0000000..3815403
--- /dev/null
+++ b/lib/providers/password_providers.dart
@@ -0,0 +1,108 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_riverpod/legacy.dart';
+
+import '../models/password_entry.dart';
+import '../models/encryption_algorithm.dart';
+import '../services/password_service.dart';
+import 'vault_providers.dart';
+
+final passwordServiceProvider = Provider<PasswordService>((ref) {
+  return PasswordService.instance;
+});
+
+final passwordSearchQueryProvider = StateProvider<String>((ref) => '');
+
+final selectedPasswordTagProvider = StateProvider<String?>((ref) => null);
+
+class PasswordsNotifier extends Notifier<AsyncValue<List<PasswordEntry>>> {
+  @override
+  AsyncValue<List<PasswordEntry>> build() {
+    loadPasswords();
+    return const AsyncValue.loading();
+  }
+
+  PasswordService get _service => ref.read(passwordServiceProvider);
+
+  bool get _isDecoy => ref.read(isDecoyModeProvider);
+
+  Future<void> loadPasswords() async {
+    state = const AsyncValue.loading();
+    try {
+      _service.clearCache();
+      final entries = await _service.loadPasswords(isDecoy: _isDecoy);
+      state = AsyncValue.data(entries);
+    } catch (e, st) {
+      state = AsyncValue.error(e, st);
+    }
+  }
+
+  Future<PasswordEntry> createPassword({
+    required String title,
+    required PasswordContent content,
+    List<String> tags = const [],
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = 100000,
+    void Function(String status, {bool isEncrypting})? onProgress,
+  }) async {
+    final entry = await _service.createPassword(
+      title: title,
+      content: content,
+      tags: tags,
+      encryptionAlgorithm: encryptionAlgorithm,
+      kdfIterations: kdfIterations,
+      isDecoy: _isDecoy,
+      onProgress: onProgress,
+    );
+    await loadPasswords();
+    _refreshVault();
+    return entry;
+  }
+
+  Future<PasswordEntry> updatePassword(
+    PasswordEntry entry, {
+    String? title,
+    PasswordContent? content,
+    List<String>? tags,
+  }) async {
+    final updated = await _service.updatePassword(
+      entry,
+      title: title,
+      content: content,
+      tags: tags,
+      encryptionAlgorithm: entry.encryptionAlgorithm,
+      kdfIterations: entry.kdfIterations,
+      isDecoy: _isDecoy,
+    );
+    await loadPasswords();
+    _refreshVault();
+    return updated;
+  }
+
+  Future<void> deletePassword(PasswordEntry entry) async {
+    await _service.deletePassword(entry, isDecoy: _isDecoy);
+    await loadPasswords();
+    _refreshVault();
+  }
+
+  Future<void> deletePasswords(List<PasswordEntry> entries) async {
+    await _service.deletePasswords(entries, isDecoy: _isDecoy);
+    await loadPasswords();
+    _refreshVault();
+  }
+
+  Future<PasswordEntry> toggleFavorite(PasswordEntry entry) async {
+    final toggled =
+        await _service.toggleFavorite(entry, isDecoy: _isDecoy);
+    await loadPasswords();
+    return toggled;
+  }
+
+  void _refreshVault() {
+    ref.invalidate(vaultNotifierProvider);
+  }
+}
+
+final passwordsNotifierProvider =
+    NotifierProvider<PasswordsNotifier, AsyncValue<List<PasswordEntry>>>(() {
+  return PasswordsNotifier();
+});
diff --git a/lib/providers/vault_providers.dart b/lib/providers/vault_providers.dart
index 656cfd7..248063f 100644
--- a/lib/providers/vault_providers.dart
+++ b/lib/providers/vault_providers.dart
@@ -71,13 +71,6 @@ final fileTypeFilterProvider = StateProvider<VaultedFileType?>((ref) {
 
 // ========== ASYNC PROVIDERS ==========
 
-/// Provider for all vaulted files
-final allFilesProvider = FutureProvider<List<VaultedFile>>((ref) async {
-  final vaultService = ref.watch(vaultServiceProvider);
-  final isDecoy = ref.watch(isDecoyModeProvider);
-  return await vaultService.getAllFiles(isDecoy: isDecoy);
-});
-
 /// Provider for sorted and filtered files
 final filteredFilesProvider = FutureProvider<List<VaultedFile>>((ref) async {
   final vaultService = ref.watch(vaultServiceProvider);
@@ -546,7 +539,7 @@ class ReEncryptNotifier extends Notifier<ReEncryptProgress> {
       }
 
       ref.invalidate(vaultSettingsProvider);
-      ref.invalidate(allFilesProvider);
+      ref.invalidate(vaultNotifierProvider);
       return result;
     } catch (e) {
       state = ReEncryptProgress(error: e.toString());
diff --git a/lib/screens/album_detail_screen.dart b/lib/screens/album_detail_screen.dart
index 25b8405..175b7c9 100644
--- a/lib/screens/album_detail_screen.dart
+++ b/lib/screens/album_detail_screen.dart
@@ -2,7 +2,7 @@ import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/album.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
@@ -642,15 +642,7 @@ class _AlbumDetailScreenState extends ConsumerState<AlbumDetailScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/albums_screen.dart b/lib/screens/albums_screen.dart
index 5d954ac..b50094a 100644
--- a/lib/screens/albums_screen.dart
+++ b/lib/screens/albums_screen.dart
@@ -234,22 +234,14 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
             final file = snapshot.data!;
             if (file.isImage) {
               final imageFile = File(file.vaultPath);
-              return FutureBuilder<bool>(
-                future: imageFile.exists(),
-                builder: (context, existsSnapshot) {
-                  if (existsSnapshot.data != true) {
-                    return _buildPlaceholderCover(album);
-                  }
-                  return Image.file(
-                    imageFile,
-                    fit: BoxFit.cover,
-                    width: double.infinity,
-                    height: double.infinity,
-                    cacheWidth: 400,
-                    filterQuality: FilterQuality.low,
-                    errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
-                  );
-                },
+              return Image.file(
+                imageFile,
+                fit: BoxFit.cover,
+                width: double.infinity,
+                height: double.infinity,
+                cacheWidth: 400,
+                filterQuality: FilterQuality.low,
+                errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
               );
             }
           }
@@ -267,22 +259,14 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
             final imageFiles = snapshot.data!.where((f) => f.isImage).toList();
             if (imageFiles.isNotEmpty) {
               final imageFile = File(imageFiles.first.vaultPath);
-              return FutureBuilder<bool>(
-                future: imageFile.exists(),
-                builder: (context, existsSnapshot) {
-                  if (existsSnapshot.data != true) {
-                    return _buildPlaceholderCover(album);
-                  }
-                  return Image.file(
-                    imageFile,
-                    fit: BoxFit.cover,
-                    width: double.infinity,
-                    height: double.infinity,
-                    cacheWidth: 400,
-                    filterQuality: FilterQuality.low,
-                    errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
-                  );
-                },
+              return Image.file(
+                imageFile,
+                fit: BoxFit.cover,
+                width: double.infinity,
+                height: double.infinity,
+                cacheWidth: 400,
+                filterQuality: FilterQuality.low,
+                errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
               );
             }
           }
@@ -650,7 +634,10 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(() {
+      nameController.dispose();
+      descController.dispose();
+    });
   }
 
   void _showRenameAlbumDialog(Album album) {
@@ -727,7 +714,7 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showDeleteAlbumDialog(Album album) {
@@ -1030,21 +1017,13 @@ class _ChangeCoverSheetState extends ConsumerState<_ChangeCoverSheet> {
             child: ClipRRect(
               borderRadius: BorderRadius.circular(isSelected ? 5 : 8),
               child: file.isImage
-                  ? FutureBuilder<bool>(
-                      future: File(file.vaultPath).exists(),
-                      builder: (context, snapshot) {
-                        if (snapshot.data != true) {
-                          return _buildPlaceholder();
-                        }
-                        return Image.file(
-                          File(file.vaultPath),
-                          fit: BoxFit.cover,
-                          cacheWidth: 200,
-                          filterQuality: FilterQuality.low,
-                          errorBuilder: (_, __, ___) => _buildPlaceholder(),
-                        );
-                      },
-                    )
+                    ? Image.file(
+                        File(file.vaultPath),
+                        fit: BoxFit.cover,
+                        cacheWidth: 200,
+                        filterQuality: FilterQuality.low,
+                        errorBuilder: (_, __, ___) => _buildPlaceholder(),
+                      )
                   : _buildVideoPlaceholder(),
             ),
           ),
diff --git a/lib/screens/autofill_selection_screen.dart b/lib/screens/autofill_selection_screen.dart
new file mode 100644
index 0000000..05be88e
--- /dev/null
+++ b/lib/screens/autofill_selection_screen.dart
@@ -0,0 +1,451 @@
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+import 'package:local_auth/local_auth.dart';
+import 'package:local_auth_android/local_auth_android.dart';
+import 'package:local_auth_darwin/local_auth_darwin.dart';
+
+import '../models/password_entry.dart';
+import '../services/auth_service.dart';
+import '../services/encryption_service.dart';
+import '../services/password_service.dart';
+import '../themes/app_colors.dart';
+
+class AutofillSelectionScreen extends StatefulWidget {
+  const AutofillSelectionScreen({super.key});
+
+  @override
+  State<AutofillSelectionScreen> createState() =>
+      _AutofillSelectionScreenState();
+}
+
+class _AutofillSelectionScreenState extends State<AutofillSelectionScreen> {
+  static const MethodChannel _channel =
+      MethodChannel('com.mossapps.locker/autofill');
+
+  final LocalAuthentication _localAuth = LocalAuthentication();
+  final TextEditingController _searchController = TextEditingController();
+
+  bool _isAuthenticating = true;
+  bool _authFailed = false;
+  bool _biometricsUnavailable = false;
+  bool _isLoadingEntries = false;
+  bool _isDecrypting = false;
+  String? _error;
+
+  List<PasswordEntry> _allEntries = [];
+  List<PasswordEntry> _filteredEntries = [];
+
+  @override
+  void initState() {
+    super.initState();
+    _authenticate();
+  }
+
+  Future<void> _authenticate() async {
+    setState(() {
+      _isAuthenticating = true;
+      _authFailed = false;
+      _biometricsUnavailable = false;
+      _error = null;
+    });
+
+    try {
+      final authService = AuthService();
+      final isBiometricEnabled = await authService.isBiometricEnabled();
+      if (!isBiometricEnabled) {
+        setState(() {
+          _biometricsUnavailable = true;
+          _isAuthenticating = false;
+        });
+        return;
+      }
+
+      final canCheck = await _localAuth.canCheckBiometrics;
+      if (!canCheck) {
+        setState(() {
+          _biometricsUnavailable = true;
+          _isAuthenticating = false;
+        });
+        return;
+      }
+
+      final didAuth = await _localAuth.authenticate(
+        localizedReason: 'Authenticate to fill passwords',
+        biometricOnly: true,
+        authMessages: const <AuthMessages>[
+          AndroidAuthMessages(
+            signInTitle: 'Latch Autofill',
+            cancelButton: 'Cancel',
+          ),
+          IOSAuthMessages(
+            cancelButton: 'Cancel',
+          ),
+        ],
+      );
+
+      if (didAuth) {
+        try {
+          await EncryptionService.instance.unlockMasterKeyWithBiometric();
+        } catch (e) {
+          setState(() {
+            _error = 'Unable to unlock vault';
+            _isAuthenticating = false;
+          });
+          return;
+        }
+        await _loadEntries();
+      } else {
+        setState(() {
+          _authFailed = true;
+          _isAuthenticating = false;
+        });
+      }
+    } on PlatformException {
+      setState(() {
+        _authFailed = true;
+        _isAuthenticating = false;
+      });
+    }
+  }
+
+  Future<void> _loadEntries() async {
+    setState(() {
+      _isLoadingEntries = true;
+      _isAuthenticating = false;
+    });
+
+    try {
+      final entries = await PasswordService.instance.loadPasswords();
+      entries.sort((a, b) {
+        if (a.isFavorite != b.isFavorite) return a.isFavorite ? -1 : 1;
+        return b.updatedAt.compareTo(a.updatedAt);
+      });
+      setState(() {
+        _allEntries = entries;
+        _filteredEntries = entries;
+        _isLoadingEntries = false;
+      });
+    } catch (e) {
+      setState(() {
+        _error = 'Failed to load passwords';
+        _isLoadingEntries = false;
+      });
+    }
+  }
+
+  void _filterEntries(String query) {
+    final q = query.toLowerCase().trim();
+    setState(() {
+      _filteredEntries = q.isEmpty
+          ? _allEntries
+          : _allEntries
+              .where((e) =>
+                  e.title.toLowerCase().contains(q) ||
+                  e.tags.any((t) => t.toLowerCase().contains(q)))
+              .toList();
+    });
+  }
+
+  Future<void> _selectEntry(PasswordEntry entry) async {
+    setState(() => _isDecrypting = true);
+
+    try {
+      final content = await PasswordService.instance.decryptContent(entry);
+      await _channel.invokeMethod('fillCredentials', {
+        'username': content.username,
+        'password': content.password,
+        'title': entry.title,
+      });
+    } catch (e) {
+      setState(() {
+        _error = 'Failed to decrypt entry';
+        _isDecrypting = false;
+      });
+    }
+  }
+
+  Future<void> _cancel() async {
+    try {
+      await _channel.invokeMethod('cancel');
+    } catch (_) {}
+  }
+
+  @override
+  void dispose() {
+    _searchController.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return PopScope(
+      canPop: false,
+      onPopInvokedWithResult: (didPop, _) {
+        if (!didPop) _cancel();
+      },
+      child: Scaffold(
+        backgroundColor: context.backgroundColor,
+        appBar: AppBar(
+          backgroundColor: context.backgroundColor,
+          elevation: 0,
+          leading: IconButton(
+            icon: Icon(Icons.close, color: context.textPrimary),
+            onPressed: _cancel,
+          ),
+          title: Text(
+            'Select Password',
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 18,
+              fontWeight: FontWeight.w600,
+              color: context.textPrimary,
+            ),
+          ),
+        ),
+        body: _buildBody(),
+      ),
+    );
+  }
+
+  Widget _buildBody() {
+    if (_isAuthenticating || _isDecrypting) {
+      return Center(
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            CircularProgressIndicator(
+              valueColor: AlwaysStoppedAnimation(context.accentColor),
+            ),
+            const SizedBox(height: 16),
+            Text(
+              _isDecrypting ? 'Decrypting...' : 'Authenticating...',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                color: context.textSecondary,
+              ),
+            ),
+          ],
+        ),
+      );
+    }
+
+    if (_biometricsUnavailable) {
+      return _buildMessageState(
+        icon: Icons.fingerprint,
+        title: 'Biometrics Required',
+        subtitle: 'Set up fingerprint or face unlock to use autofill',
+        showRetry: false,
+      );
+    }
+
+    if (_authFailed) {
+      return _buildMessageState(
+        icon: Icons.lock_outline,
+        title: 'Authentication Failed',
+        subtitle: 'Tap to try again',
+        showRetry: true,
+      );
+    }
+
+    if (_error != null) {
+      return _buildMessageState(
+        icon: Icons.error_outline,
+        title: _error!,
+        subtitle: 'Tap to retry',
+        showRetry: true,
+      );
+    }
+
+    if (_isLoadingEntries) {
+      return Center(
+        child: CircularProgressIndicator(
+          valueColor: AlwaysStoppedAnimation(context.accentColor),
+        ),
+      );
+    }
+
+    if (_allEntries.isEmpty) {
+      return _buildMessageState(
+        icon: Icons.password_outlined,
+        title: 'No Passwords Saved',
+        subtitle: 'Add passwords in Latch to use autofill',
+        showRetry: false,
+      );
+    }
+
+    return Column(
+      children: [
+        _buildSearchField(),
+        Expanded(child: _buildList()),
+      ],
+    );
+  }
+
+  Widget _buildMessageState({
+    required IconData icon,
+    required String title,
+    required String subtitle,
+    required bool showRetry,
+  }) {
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.all(32),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            Icon(icon, size: 64, color: context.textTertiary),
+            const SizedBox(height: 16),
+            Text(
+              title,
+              textAlign: TextAlign.center,
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 18,
+                fontWeight: FontWeight.w600,
+                color: context.textPrimary,
+              ),
+            ),
+            const SizedBox(height: 8),
+            Text(
+              subtitle,
+              textAlign: TextAlign.center,
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                color: context.textSecondary,
+              ),
+            ),
+            if (showRetry) ...[
+              const SizedBox(height: 24),
+              FilledButton(
+                onPressed: _authenticate,
+                style: FilledButton.styleFrom(
+                  backgroundColor: context.accentColor,
+                ),
+                child: Text(
+                  'Retry',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    color: Colors.white,
+                  ),
+                ),
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildSearchField() {
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(16, 12, 16, 8),
+      child: TextField(
+        controller: _searchController,
+        onChanged: _filterEntries,
+        style: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 15,
+          color: context.textPrimary,
+        ),
+        decoration: InputDecoration(
+          hintText: 'Search passwords...',
+          hintStyle: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 15,
+            color: context.textTertiary,
+          ),
+          prefixIcon: Icon(Icons.search, color: context.textTertiary, size: 20),
+          filled: true,
+          fillColor: context.surfaceColor,
+          isDense: true,
+          border: OutlineInputBorder(
+            borderRadius: BorderRadius.circular(12),
+            borderSide: BorderSide(color: context.borderColor),
+          ),
+          enabledBorder: OutlineInputBorder(
+            borderRadius: BorderRadius.circular(12),
+            borderSide: BorderSide(color: context.borderColor),
+          ),
+          focusedBorder: OutlineInputBorder(
+            borderRadius: BorderRadius.circular(12),
+            borderSide: BorderSide(color: context.accentColor),
+          ),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildList() {
+    if (_filteredEntries.isEmpty) {
+      return Center(
+        child: Text(
+          'No matches',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textTertiary,
+          ),
+        ),
+      );
+    }
+
+    return ListView.builder(
+      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 4),
+      itemCount: _filteredEntries.length,
+      itemBuilder: (context, index) {
+        final entry = _filteredEntries[index];
+        return _buildEntryTile(entry);
+      },
+    );
+  }
+
+  Widget _buildEntryTile(PasswordEntry entry) {
+    return Container(
+      margin: const EdgeInsets.only(bottom: 8),
+      decoration: BoxDecoration(
+        color: context.surfaceColor,
+        borderRadius: BorderRadius.circular(12),
+        border: Border.all(color: context.borderColor),
+      ),
+      child: ListTile(
+        contentPadding: const EdgeInsets.symmetric(horizontal: 16, vertical: 4),
+        leading: Icon(
+          entry.isFavorite ? Icons.star : Icons.lock_outline,
+          color: entry.isFavorite ? context.accentColor : context.textTertiary,
+          size: 22,
+        ),
+        title: Text(
+          entry.title,
+          maxLines: 1,
+          overflow: TextOverflow.ellipsis,
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 15,
+            fontWeight: FontWeight.w600,
+            color: context.textPrimary,
+          ),
+        ),
+        subtitle: entry.tags.isNotEmpty
+            ? Text(
+                entry.tags.join(' · '),
+                maxLines: 1,
+                overflow: TextOverflow.ellipsis,
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 12,
+                  color: context.textTertiary,
+                ),
+              )
+            : null,
+        trailing: Icon(
+          Icons.chevron_right,
+          color: context.textTertiary,
+          size: 20,
+        ),
+        onTap: () => _selectEntry(entry),
+      ),
+    );
+  }
+}
diff --git a/lib/screens/change_security_screen.dart b/lib/screens/change_security_screen.dart
index 38516c1..f8e433e 100644
--- a/lib/screens/change_security_screen.dart
+++ b/lib/screens/change_security_screen.dart
@@ -3,6 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import '../themes/app_colors.dart';
 import '../services/auth_service.dart';
+import '../services/encryption_service.dart';
 import '../utils/toast_utils.dart';
 import '../widgets/adaptive_logo.dart';
 import 'gallery_vault_screen.dart';
@@ -348,19 +349,7 @@ class _ChangeSecurityScreenState extends State<ChangeSecurityScreen> {
                   color: AppColors.darkSuccess.withValues(alpha: 0.15),
                   borderRadius: BorderRadius.circular(20),
                 ),
-                child: Row(
-                  mainAxisSize: MainAxisSize.min,
-                  children: [
-                    Container(
-                      width: 6,
-                      height: 6,
-                      decoration: BoxDecoration(
-                        color: AppColors.darkSuccess,
-                        shape: BoxShape.circle,
-                      ),
-                    ),
-                    const SizedBox(width: 6),
-                    Text(
+                child: Text(
                       'Active',
                       style: TextStyle(
                         fontSize: 12,
@@ -369,8 +358,6 @@ class _ChangeSecurityScreenState extends State<ChangeSecurityScreen> {
                         color: AppColors.darkSuccess,
                       ),
                     ),
-                  ],
-                ),
               ),
             ],
           ),
@@ -538,9 +525,11 @@ class _ChangePasswordScreenState extends State<ChangePasswordScreen> {
         _errorMessage = null;
       });
     } else if (_step == 1) {
-      if (_newPasswordController.text.isEmpty) {
+      if (_newPasswordController.text.length <
+          AuthService.minPasswordLength) {
         setState(() {
-          _errorMessage = 'Please enter a new password';
+          _errorMessage =
+              'Use at least ${AuthService.minPasswordLength} characters';
         });
         return;
       }
@@ -579,6 +568,8 @@ class _ChangePasswordScreenState extends State<ChangePasswordScreen> {
         // Update auth method to password
         if (success) {
           await _authService.setAuthMethod('password');
+          await EncryptionService.instance.reWrapKey(_newPasswordController.text);
+          await EncryptionService.instance.removeBiometricKwk();
         }
       } else {
         success = await _authService.switchFromPINToPassword(
@@ -1202,6 +1193,8 @@ class _ChangePINScreenState extends State<ChangePINScreen> {
         // Update auth method to PIN
         if (success) {
           await _authService.setAuthMethod('pin');
+          await EncryptionService.instance.reWrapKey(_newPINController.text);
+          await EncryptionService.instance.removeBiometricKwk();
         }
       } else {
         success = await _authService.switchFromPasswordToPIN(
diff --git a/lib/screens/document_picker_screen.dart b/lib/screens/document_picker_screen.dart
index ec06d83..8e6ec61 100644
--- a/lib/screens/document_picker_screen.dart
+++ b/lib/screens/document_picker_screen.dart
@@ -1,6 +1,7 @@
 import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:mime/mime.dart';
 import '../models/vaulted_file.dart';
 import '../themes/app_colors.dart';
@@ -239,11 +240,7 @@ class _DocumentPickerScreenState extends State<DocumentPickerScreen> {
         }
 
         // Also check common locations
-        final commonPaths = [
-          '/storage/emulated/0/Download',
-          '/storage/emulated/0/Documents',
-          '/storage/emulated/0/DCIM',
-        ];
+        final commonPaths = PathUtils.androidSourceRoots;
 
         for (final path in commonPaths) {
           final dir = Directory(path);
diff --git a/lib/screens/document_viewer_screen.dart b/lib/screens/document_viewer_screen.dart
index a321d73..e1ad5af 100644
--- a/lib/screens/document_viewer_screen.dart
+++ b/lib/screens/document_viewer_screen.dart
@@ -3,7 +3,7 @@ import 'dart:typed_data';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:pdfrx/pdfrx.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
@@ -293,15 +293,7 @@ class _DocumentViewerScreenState extends ConsumerState<DocumentViewerScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/encryption_settings_screen.dart b/lib/screens/encryption_settings_screen.dart
index 8d78a10..96987c9 100644
--- a/lib/screens/encryption_settings_screen.dart
+++ b/lib/screens/encryption_settings_screen.dart
@@ -16,7 +16,7 @@ class EncryptionSettingsScreen extends ConsumerStatefulWidget {
 
 class _EncryptionSettingsScreenState
     extends ConsumerState<EncryptionSettingsScreen> {
-  static const List<int> _kdfIterationOptions = [100000, 200000, 500000];
+  static const List<int> _kdfIterationOptions = [100000, 300000, 600000, 1000000];
 
   @override
   Widget build(BuildContext context) {
diff --git a/lib/screens/favorites_screen.dart b/lib/screens/favorites_screen.dart
index 18025df..113863f 100644
--- a/lib/screens/favorites_screen.dart
+++ b/lib/screens/favorites_screen.dart
@@ -2,7 +2,7 @@ import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vaulted_file.dart';
 import '../models/album.dart';
 import '../providers/vault_providers.dart';
@@ -674,15 +674,7 @@ class _FavoritesScreenState extends ConsumerState<FavoritesScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/folder_detail_screen.dart b/lib/screens/folder_detail_screen.dart
index 65a7ad3..681b6f8 100644
--- a/lib/screens/folder_detail_screen.dart
+++ b/lib/screens/folder_detail_screen.dart
@@ -525,50 +525,20 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
   Widget _buildFileThumbnail(VaultedFile file) {
     if (file.isImage) {
       final imageFile = File(file.vaultPath);
-      return FutureBuilder<bool>(
-        future: imageFile.exists(),
-        builder: (context, snapshot) {
-          if (snapshot.data != true) {
-            return _buildFilePlaceholder(file);
-          }
-          return Image.file(
-            imageFile,
-            fit: BoxFit.cover,
-            cacheWidth: 200,
-            filterQuality: FilterQuality.low,
-            errorBuilder: (_, __, ___) => _buildFilePlaceholder(file),
-          );
-        },
+      return Image.file(
+        imageFile,
+        fit: BoxFit.cover,
+        cacheWidth: 200,
+        filterQuality: FilterQuality.low,
+        errorBuilder: (_, __, ___) => _buildFilePlaceholder(file),
       );
     }
     return _buildFilePlaceholder(file);
   }
 
   Widget _buildFilePlaceholder(VaultedFile file) {
-    IconData icon;
-    Color color;
-    switch (file.type) {
-      case VaultedFileType.image:
-        icon = Icons.image;
-        color = context.accentColor;
-        break;
-      case VaultedFileType.video:
-        icon = Icons.videocam;
-        color = Colors.red;
-        break;
-      case VaultedFileType.song:
-        icon = Icons.music_note;
-        color = Colors.purple;
-        break;
-      case VaultedFileType.document:
-        icon = Icons.description;
-        color = Colors.green;
-        break;
-      case VaultedFileType.other:
-        icon = Icons.insert_drive_file;
-        color = Colors.grey;
-        break;
-    }
+    final color = FileTypeColors.colorForType(file.type, accent: context.accentColor);
+    final icon = FileTypeColors.iconForType(file.type);
     return Container(
       color: color.withValues(alpha: 0.1),
       child: Column(
@@ -1053,7 +1023,7 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showSubfolderOptions(VaultFolder subfolder) {
@@ -1195,7 +1165,7 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showDeleteSubfolderDialog(VaultFolder subfolder) {
diff --git a/lib/screens/folders_screen.dart b/lib/screens/folders_screen.dart
index 71ef7e7..8c54db1 100644
--- a/lib/screens/folders_screen.dart
+++ b/lib/screens/folders_screen.dart
@@ -230,22 +230,14 @@ class _FoldersScreenState extends ConsumerState<FoldersScreen> {
             final file = snapshot.data!;
             if (file.isImage) {
               final imageFile = File(file.vaultPath);
-              return FutureBuilder<bool>(
-                future: imageFile.exists(),
-                builder: (context, existsSnapshot) {
-                  if (existsSnapshot.data != true) {
-                    return _buildPlaceholderCover();
-                  }
-                  return Image.file(
-                    imageFile,
-                    fit: BoxFit.cover,
-                    width: double.infinity,
-                    height: double.infinity,
-                    cacheWidth: 400,
-                    filterQuality: FilterQuality.low,
-                    errorBuilder: (_, __, ___) => _buildPlaceholderCover(),
-                  );
-                },
+              return Image.file(
+                imageFile,
+                fit: BoxFit.cover,
+                width: double.infinity,
+                height: double.infinity,
+                cacheWidth: 400,
+                filterQuality: FilterQuality.low,
+                errorBuilder: (_, __, ___) => _buildPlaceholderCover(),
               );
             }
           }
@@ -627,7 +619,10 @@ class _FoldersScreenState extends ConsumerState<FoldersScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(() {
+      nameController.dispose();
+      descController.dispose();
+    });
   }
 
   void _showCreateSubfolderDialog(VaultFolder parentFolder) {
@@ -708,7 +703,7 @@ class _FoldersScreenState extends ConsumerState<FoldersScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showDeleteFolderDialog(VaultFolder folder) {
diff --git a/lib/screens/gallery_vault_screen.dart b/lib/screens/gallery_vault_screen.dart
index 2d09e91..0e03f4d 100644
--- a/lib/screens/gallery_vault_screen.dart
+++ b/lib/screens/gallery_vault_screen.dart
@@ -8,6 +8,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_svg/flutter_svg.dart';
 import 'package:open_filex/open_filex.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/encryption_algorithm.dart';
 import '../models/vaulted_file.dart';
 import '../models/album.dart';
@@ -34,7 +35,9 @@ import 'camera_screen.dart';
 import 'audio_recorder_screen.dart';
 import 'vault_settings_screen.dart';
 import 'note_editor_screen.dart';
+import 'password_editor_screen.dart';
 import '../providers/note_providers.dart';
+import '../providers/password_providers.dart';
 import '../widgets/operation_progress_sheet.dart';
 import '../widgets/media_hold_action_sheet.dart';
 import '../widgets/media_multi_select_action_sheet.dart';
@@ -160,6 +163,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         backgroundColor: context.accentColor,
         leading: IconButton(
           icon: const Icon(Icons.close, color: Colors.white),
+          tooltip: 'Exit selection',
           onPressed: _exitSelectionMode,
         ),
         title: Text(
@@ -206,6 +210,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
             _isSearching ? Icons.close : Icons.search,
             color: context.textPrimary,
           ),
+          tooltip: _isSearching ? 'Close search' : 'Search',
           onPressed: () {
             setState(() {
               _isSearching = !_isSearching;
@@ -218,9 +223,11 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         ),
         IconButton(
           icon: Icon(Icons.sort, color: context.textPrimary),
+          tooltip: 'Sort',
           onPressed: _showSortOptions,
         ),
         PopupMenuButton<String>(
+          tooltip: 'More options',
           icon: Icon(Icons.more_vert, color: context.textPrimary),
           onSelected: (value) {
             switch (value) {
@@ -909,34 +916,21 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
     if (file.isImage) {
       final imageFile = File(file.vaultPath);
 
-      // Use FutureBuilder to check file existence first
-      return FutureBuilder<bool>(
-        future: imageFile.exists(),
-        builder: (context, snapshot) {
-          if (snapshot.data != true) {
-            return _buildPlaceholder(file);
+      return Image.file(
+        imageFile,
+        fit: BoxFit.cover,
+        cacheWidth: 300,
+        filterQuality: FilterQuality.low,
+        gaplessPlayback: true,
+        frameBuilder: (context, child, frame, wasSynchronouslyLoaded) {
+          if (wasSynchronouslyLoaded || frame != null) {
+            return child;
           }
-
-          // Use Image.file with defensive error handling
-          return Image.file(
-            imageFile,
-            fit: BoxFit.cover,
-            cacheWidth: 300, // Limit resolution for performance
-            filterQuality: FilterQuality.low,
-            gaplessPlayback: true,
-            frameBuilder: (context, child, frame, wasSynchronouslyLoaded) {
-              if (wasSynchronouslyLoaded || frame != null) {
-                return child;
-              }
-              // Show placeholder while loading
-              return const _ImageLoadingPlaceholder();
-            },
-            errorBuilder: (context, error, stackTrace) {
-              // Log error for debugging but show placeholder gracefully
-              debugPrint('Error loading image: ${file.originalName} - $error');
-              return _buildPlaceholder(file);
-            },
-          );
+          return const _ImageLoadingPlaceholder();
+        },
+        errorBuilder: (context, error, stackTrace) {
+          debugPrint('Error loading image: ${file.originalName} - $error');
+          return _buildPlaceholder(file);
         },
       );
     }
@@ -1156,6 +1150,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       currentFiles: filesAsync.value ?? [],
       onUnsupported: () => _showFileOptionsSheet(file),
       onOpenNote: (noteId) => _openNoteFromVault(noteId),
+      onOpenPassword: (passwordId) => _openPasswordFromVault(passwordId),
     );
   }
 
@@ -1174,6 +1169,21 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
     });
   }
 
+  void _openPasswordFromVault(String passwordId) {
+    final passwordsAsync = ref.read(passwordsNotifierProvider);
+    passwordsAsync.whenData((passwords) {
+      final entry = passwords.where((p) => p.id == passwordId).firstOrNull;
+      if (entry != null && mounted) {
+        Navigator.push(
+          context,
+          MaterialPageRoute(
+            builder: (_) => PasswordEditorScreen(entry: entry),
+          ),
+        );
+      }
+    });
+  }
+
   /// Show options for files that don't have a preview
   void _showFileOptionsSheet(VaultedFile file) {
     showModalBottomSheet(
@@ -1402,15 +1412,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       );
 
       // Get the Downloads directory
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
@@ -2366,6 +2368,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
                                 color: AppColors.lightTextSecondary),
                             suffixIcon: IconButton(
                               icon: Icon(Icons.add, color: context.accentColor),
+                              tooltip: 'Add tag',
                               onPressed: () async {
                                 final tag = tagController.text.trim();
                                 if (tag.isEmpty) return;
@@ -2530,7 +2533,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
           );
         },
       ),
-    );
+    ).whenComplete(tagController.dispose);
   }
 
   Future<void> _toggleFavoriteSelected(Set<String> selectedFiles) async {
@@ -2988,7 +2991,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
           ),
         ],
       ),
-    );
+    ).whenComplete(pinController.dispose);
   }
 
   // Import methods
@@ -3391,7 +3394,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginal: true,
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       ToastUtils.showSuccess('Photo captured and hidden');
@@ -3421,7 +3424,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginal: true,
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       ToastUtils.showSuccess('Video recorded and hidden');
@@ -3450,7 +3453,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginal: true,
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       ToastUtils.showSuccess('Audio recorded and hidden');
@@ -3535,6 +3538,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         return confirmed ?? false;
       },
       onProgress: (current, total) {
+        if (!mounted) return;
         setState(() {
           _importProgress = current;
           _importTotal = total;
@@ -3545,7 +3549,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       },
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       final msgBuilder =
@@ -3631,6 +3635,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginals: true,
       perFileEncryption: perFileEncryption,
       onProgress: (current, total) {
+        if (!mounted) return;
         setState(() {
           _importProgress = current;
           _importTotal = total;
@@ -3638,7 +3643,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       },
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       final msg = result.deletedOriginals
@@ -3717,6 +3722,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginals: true,
       perFileEncryption: perFileEncryption,
       onProgress: (current, total) {
+        if (!mounted) return;
         setState(() {
           _importProgress = current;
           _importTotal = total;
@@ -3724,7 +3730,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       },
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (importResult.success && importResult.importedCount > 0) {
       final msg = importResult.deletedOriginals
@@ -3763,6 +3769,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         recursive: true,
         deleteOriginals: false,
         onProgress: (current, total) {
+          if (!mounted) return;
           setState(() {
             _importProgress = current;
             _importTotal = total;
@@ -3770,7 +3777,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         },
       );
 
-      setState(() => _isImporting = false);
+      if (mounted) setState(() => _isImporting = false);
 
       if (result.success && result.filesImported > 0) {
         ToastUtils.showSuccess(result.message ??
@@ -3783,7 +3790,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         ToastUtils.showInfo('No files found in folder');
       }
     } catch (e) {
-      setState(() => _isImporting = false);
+      if (mounted) setState(() => _isImporting = false);
       ToastUtils.showError('Failed to import folder: $e');
     }
   }
@@ -4198,6 +4205,7 @@ class _FolderImportPickerScreenState extends State<_FolderImportPickerScreen> {
         leading: _pathStack.isNotEmpty
             ? IconButton(
                 icon: const Icon(Icons.arrow_back),
+                tooltip: 'Back',
                 onPressed: _goBack,
                 color: context.textPrimary,
               )
diff --git a/lib/screens/local_backup_screen.dart b/lib/screens/local_backup_screen.dart
index 9a5ac07..52bc44d 100644
--- a/lib/screens/local_backup_screen.dart
+++ b/lib/screens/local_backup_screen.dart
@@ -1,7 +1,7 @@
-import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vaulted_file.dart';
 import '../services/backup_service.dart';
 import '../themes/app_colors.dart';
@@ -35,13 +35,7 @@ class _LocalBackupScreenState extends ConsumerState<LocalBackupScreen> {
         SaveLocation(
           name: 'Downloads',
           resolvePath: () async {
-            if (Platform.isAndroid) {
-              final d = Directory('/storage/emulated/0/Download');
-              if (await d.exists()) return d.path;
-              final ext = await getExternalStorageDirectory();
-              return ext?.path;
-            }
-            final d = await getDownloadsDirectory();
+            final d = await PathUtils.getDownloadsDirectory();
             return d?.path;
           },
         ),
diff --git a/lib/screens/media_viewer_screen.dart b/lib/screens/media_viewer_screen.dart
index 160db2d..c855949 100644
--- a/lib/screens/media_viewer_screen.dart
+++ b/lib/screens/media_viewer_screen.dart
@@ -4,7 +4,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:photo_view/photo_view.dart';
 import 'package:photo_view/photo_view_gallery.dart';
 import 'package:video_player/video_player.dart';
@@ -704,15 +704,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
@@ -840,13 +832,17 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                           ),
                         ),
                         const SizedBox(width: 8),
-                        GestureDetector(
-                          onTap: () => setState(() => _isSlideshow = false),
-                          child: const Icon(
+                        IconButton(
+                          icon: const Icon(
                             Icons.close,
                             color: Colors.white,
                             size: 18,
                           ),
+                          onPressed: () => setState(() => _isSlideshow = false),
+                          tooltip: 'Close slideshow',
+                          padding: EdgeInsets.zero,
+                          constraints: const BoxConstraints(
+                              minWidth: 36, minHeight: 36),
                         ),
                       ],
                     ),
@@ -899,20 +895,12 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
             minScale: PhotoViewComputedScale.contained,
             maxScale: PhotoViewComputedScale.covered * 3,
             heroAttributes: PhotoViewHeroAttributes(tag: file.id),
-            child: FutureBuilder<bool>(
-              future: File(file.vaultPath).exists(),
-              builder: (context, snapshot) {
-                if (snapshot.data != true) {
-                  return _buildImageErrorPlaceholder(file);
-                }
-                return Image.file(
-                  File(file.vaultPath),
-                  fit: BoxFit.contain,
-                  errorBuilder: (context, error, stackTrace) {
-                    debugPrint('Error decoding image file: $error');
-                    return _buildImageErrorPlaceholder(file);
-                  },
-                );
+            child: Image.file(
+              File(file.vaultPath),
+              fit: BoxFit.contain,
+              errorBuilder: (context, error, stackTrace) {
+                debugPrint('Error decoding image file: $error');
+                return _buildImageErrorPlaceholder(file);
               },
             ),
           ),
@@ -1039,6 +1027,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                     IconButton(
                       icon: const Icon(Icons.replay_10, size: 36),
                       color: Colors.white,
+                      tooltip: 'Back 10 seconds',
                       onPressed: _skipBackward,
                     ),
                     IconButton(
@@ -1047,11 +1036,13 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                         size: 48,
                         color: Colors.white,
                       ),
+                      tooltip: _isVideoPlaying ? 'Pause' : 'Play',
                       onPressed: _toggleVideoPlayback,
                     ),
                     IconButton(
                       icon: const Icon(Icons.forward_10, size: 36),
                       color: Colors.white,
+                      tooltip: 'Forward 10 seconds',
                       onPressed: _skipForward,
                     ),
                   ],
@@ -1127,6 +1118,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
           children: [
             IconButton(
               icon: const Icon(Icons.arrow_back, color: Colors.white),
+              tooltip: 'Back',
               onPressed: () => Navigator.pop(context),
             ),
             Expanded(
@@ -1160,6 +1152,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                 file.isFavorite ? Icons.favorite : Icons.favorite_border,
                 color: file.isFavorite ? Colors.red : Colors.white,
               ),
+              tooltip: 'Favorite',
               onPressed: _toggleFavorite,
             ),
             if (file.isVideo)
@@ -1168,10 +1161,12 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                   _isLooping ? Icons.repeat_one : Icons.repeat,
                   color: _isLooping ? AppColors.accent : Colors.white,
                 ),
+                tooltip: 'Loop',
                 onPressed: _toggleLooping,
               ),
             IconButton(
               icon: const Icon(Icons.info_outline, color: Colors.white),
+              tooltip: 'File info',
               onPressed: _showFileInfo,
             ),
           ],
@@ -1265,39 +1260,42 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
               Row(
                 mainAxisAlignment: MainAxisAlignment.spaceEvenly,
                 children: [
-                  IconButton(
-                    icon: Icon(
-                      _isMuted ? Icons.volume_off : Icons.volume_up,
-                      color: Colors.white,
-                    ),
-                    onPressed: () {
+                   IconButton(
+                     icon: Icon(
+                       _isMuted ? Icons.volume_off : Icons.volume_up,
+                       color: Colors.white,
+                     ),
+                     tooltip: _isMuted ? 'Unmute' : 'Mute',
+                     onPressed: () {
                       setState(() {
                         _isMuted = !_isMuted;
                         _videoController?.setVolume(_isMuted ? 0.0 : 1.0);
                       });
                     },
                   ),
-                  IconButton(
-                    icon: Icon(
-                      _isVideoPlaying
-                          ? Icons.pause_circle_filled
-                          : Icons.play_circle_filled,
-                      color: Colors.white,
-                      size: 48,
-                    ),
-                    onPressed: _toggleVideoPlayback,
-                  ),
-                  IconButton(
-                    icon: Text(
-                      '${_playbackSpeed}x',
-                      style: const TextStyle(
-                        color: Colors.white,
-                        fontWeight: FontWeight.bold,
-                        fontSize: 14,
-                        fontFamily: 'ProductSans',
-                      ),
-                    ),
-                    onPressed: () {
+                   IconButton(
+                     icon: Icon(
+                       _isVideoPlaying
+                           ? Icons.pause_circle_filled
+                           : Icons.play_circle_filled,
+                       color: Colors.white,
+                       size: 48,
+                     ),
+                     tooltip: _isVideoPlaying ? 'Pause' : 'Play',
+                     onPressed: _toggleVideoPlayback,
+                   ),
+                   IconButton(
+                     icon: Text(
+                       '${_playbackSpeed}x',
+                       style: const TextStyle(
+                         color: Colors.white,
+                         fontWeight: FontWeight.bold,
+                         fontSize: 14,
+                         fontFamily: 'ProductSans',
+                       ),
+                     ),
+                     tooltip: 'Playback speed',
+                     onPressed: () {
                       setState(() {
                         if (_playbackSpeed == 1.0) {
                           _playbackSpeed = 1.5;
@@ -1354,6 +1352,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                   // Previous
                   IconButton(
                     icon: const Icon(Icons.skip_previous, color: Colors.white),
+                    tooltip: 'Previous',
                     onPressed: _currentIndex > 0
                         ? () => _pageController.previousPage(
                               duration: const Duration(milliseconds: 300),
@@ -1368,21 +1367,25 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                         _isSlideshow ? Icons.stop : Icons.slideshow,
                         color: Colors.white,
                       ),
+                      tooltip: 'Slideshow',
                       onPressed: _showSlideshowSettings,
                     ),
                   // Share/Export
                   IconButton(
                     icon: const Icon(Icons.share, color: Colors.white),
+                    tooltip: 'Share',
                     onPressed: () => _showExportOptions(file),
                   ),
                   // Delete
                   IconButton(
                     icon: const Icon(Icons.delete_outline, color: Colors.white),
+                    tooltip: 'Delete',
                     onPressed: () => _confirmDelete(file),
                   ),
                   // Next
                   IconButton(
                     icon: const Icon(Icons.skip_next, color: Colors.white),
+                    tooltip: 'Next',
                     onPressed: _currentIndex < widget.files.length - 1
                         ? () => _pageController.nextPage(
                               duration: const Duration(milliseconds: 300),
diff --git a/lib/screens/note_editor_screen.dart b/lib/screens/note_editor_screen.dart
index b9f8109..8cfe993 100644
--- a/lib/screens/note_editor_screen.dart
+++ b/lib/screens/note_editor_screen.dart
@@ -182,10 +182,14 @@ class _NoteEditorScreenState extends ConsumerState<NoteEditorScreen> {
                           ),
                         ),
                       ),
-                      GestureDetector(
-                        onTap: () => setState(() => _folderId = null),
-                        child: Icon(Icons.close,
+                      IconButton(
+                        icon: Icon(Icons.close,
                             size: 14, color: context.textTertiary),
+                        onPressed: () => setState(() => _folderId = null),
+                        tooltip: 'Clear folder',
+                        padding: EdgeInsets.zero,
+                        constraints: const BoxConstraints(
+                            minWidth: 36, minHeight: 36),
                       ),
                     ],
                   ),
@@ -372,7 +376,7 @@ class _NoteEditorScreenState extends ConsumerState<NoteEditorScreen> {
                     color: context.textPrimary,
                   ),
                 ),
-                onTap: () => Navigator.pop(context, null),
+                onTap: () => Navigator.pop(context, ''),
               ),
               ...folders.map((folder) => ListTile(
                     leading: Icon(Icons.folder, color: context.accentColor),
@@ -392,10 +396,8 @@ class _NoteEditorScreenState extends ConsumerState<NoteEditorScreen> {
       },
     );
 
-    if (selected != null || selected == null) {
-      setState(() {
-        _folderId = selected;
-      });
+    if (selected != null) {
+      setState(() => _folderId = selected.isEmpty ? null : selected);
     }
   }
 }
diff --git a/lib/screens/note_list_screen.dart b/lib/screens/note_list_screen.dart
index 6551671..a8cb6e4 100644
--- a/lib/screens/note_list_screen.dart
+++ b/lib/screens/note_list_screen.dart
@@ -704,7 +704,10 @@ class _NoteListScreenState extends ConsumerState<NoteListScreen> {
           },
         );
       },
-    );
+    ).whenComplete(() {
+      titleController.dispose();
+      contentController.dispose();
+    });
   }
 
   Future<void> _showDeleteConfirmation() async {
diff --git a/lib/screens/password_editor_screen.dart b/lib/screens/password_editor_screen.dart
new file mode 100644
index 0000000..c2cba9d
--- /dev/null
+++ b/lib/screens/password_editor_screen.dart
@@ -0,0 +1,582 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import '../models/password_entry.dart';
+import '../models/encryption_algorithm.dart';
+import '../providers/password_providers.dart';
+import '../themes/app_colors.dart';
+import '../utils/clipboard_util.dart';
+import '../utils/toast_utils.dart';
+import '../widgets/password_generator_sheet.dart';
+
+class PasswordEditorScreen extends ConsumerStatefulWidget {
+  final PasswordEntry? entry;
+
+  const PasswordEditorScreen({super.key, this.entry});
+
+  @override
+  ConsumerState<PasswordEditorScreen> createState() =>
+      _PasswordEditorScreenState();
+}
+
+class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
+  final TextEditingController _titleController = TextEditingController();
+  final TextEditingController _usernameController = TextEditingController();
+  final TextEditingController _passwordController = TextEditingController();
+  final TextEditingController _urlController = TextEditingController();
+  final TextEditingController _notesController = TextEditingController();
+  final TextEditingController _tagController = TextEditingController();
+
+  bool _isSaving = false;
+  bool _isLoading = false;
+  bool _obscurePassword = true;
+  bool _isFavorite = false;
+  List<String> _tags = [];
+  EncryptionAlgorithm _algorithm = EncryptionAlgorithm.aes256Gcm;
+  int _kdfIterations = 100000;
+
+  @override
+  void initState() {
+    super.initState();
+    if (widget.entry != null) {
+      _isLoading = true;
+      _titleController.text = widget.entry!.title;
+      _tags = List.from(widget.entry!.tags);
+      _isFavorite = widget.entry!.isFavorite;
+      _algorithm = widget.entry!.encryptionAlgorithm;
+      _kdfIterations = widget.entry!.kdfIterations;
+      _loadContent();
+    }
+  }
+
+  Future<void> _loadContent() async {
+    if (widget.entry == null) return;
+    try {
+      final content = await ref
+          .read(passwordServiceProvider)
+          .decryptContent(widget.entry!);
+      if (mounted) {
+        setState(() {
+          _usernameController.text = content.username;
+          _passwordController.text = content.password;
+          _urlController.text = content.url;
+          _notesController.text = content.notes;
+          _isLoading = false;
+        });
+      }
+    } catch (e) {
+      if (mounted) {
+        setState(() => _isLoading = false);
+        ToastUtils.showError('Failed to load entry');
+      }
+    }
+  }
+
+  @override
+  void dispose() {
+    _titleController.dispose();
+    _usernameController.dispose();
+    _passwordController.dispose();
+    _urlController.dispose();
+    _notesController.dispose();
+    _tagController.dispose();
+    super.dispose();
+  }
+
+  void _addTag() {
+    final tag = _tagController.text.trim().toLowerCase();
+    if (tag.isNotEmpty && !_tags.contains(tag)) {
+      setState(() {
+        _tags.add(tag);
+        _tagController.clear();
+      });
+    }
+  }
+
+  void _showGenerator() {
+    showModalBottomSheet(
+      context: context,
+      backgroundColor: context.backgroundColor,
+      isScrollControlled: true,
+      shape: const RoundedRectangleBorder(
+        borderRadius: BorderRadius.vertical(top: Radius.circular(20)),
+      ),
+      builder: (context) => PasswordGeneratorSheet(
+        onGenerate: (password) {
+          setState(() {
+            _passwordController.text = password;
+            _obscurePassword = false;
+          });
+        },
+      ),
+    );
+  }
+
+  void _copyField(String value, String label) {
+    if (value.isEmpty) {
+      ToastUtils.showInfo('$label is empty');
+      return;
+    }
+    ClipboardUtil.copyWithAutoClear(value);
+    ToastUtils.showSuccess('$label copied - clears in 20s');
+  }
+
+  Future<void> _save() async {
+    if (_titleController.text.trim().isEmpty) {
+      ToastUtils.showError('Title cannot be empty');
+      return;
+    }
+
+    setState(() => _isSaving = true);
+
+    try {
+      final content = PasswordContent(
+        username: _usernameController.text,
+        password: _passwordController.text,
+        url: _urlController.text,
+        notes: _notesController.text,
+      );
+
+      final notifier = ref.read(passwordsNotifierProvider.notifier);
+      if (widget.entry != null) {
+        await notifier.updatePassword(
+          widget.entry!,
+          title: _titleController.text.trim(),
+          content: content,
+          tags: _tags,
+        );
+        if (widget.entry!.isFavorite != _isFavorite) {
+          await notifier.toggleFavorite(widget.entry!);
+        }
+        if (mounted) ToastUtils.showSuccess('Entry updated');
+      } else {
+        await notifier.createPassword(
+          title: _titleController.text.trim(),
+          content: content,
+          tags: _tags,
+          encryptionAlgorithm: _algorithm,
+          kdfIterations: _kdfIterations,
+        );
+        if (mounted) ToastUtils.showSuccess('Entry created');
+      }
+      if (mounted) Navigator.pop(context);
+    } catch (e) {
+      if (mounted) ToastUtils.showError('Failed to save entry');
+    } finally {
+      if (mounted) setState(() => _isSaving = false);
+    }
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final isEditing = widget.entry != null;
+
+    return Scaffold(
+      backgroundColor: context.backgroundColor,
+      appBar: AppBar(
+        backgroundColor: context.backgroundColor,
+        elevation: 0,
+        leading: IconButton(
+          icon: Icon(Icons.arrow_back, color: context.textPrimary),
+          onPressed: () => Navigator.pop(context),
+        ),
+        title: Text(
+          isEditing ? 'Edit Entry' : 'New Entry',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 18,
+            fontWeight: FontWeight.w600,
+            color: context.textPrimary,
+          ),
+        ),
+        actions: [
+          IconButton(
+            icon: Icon(
+              _isFavorite ? Icons.star : Icons.star_border,
+              color: _isFavorite
+                  ? context.accentColor
+                  : context.textSecondary,
+            ),
+            onPressed: () => setState(() => _isFavorite = !_isFavorite),
+            tooltip: 'Favorite',
+          ),
+          IconButton(
+            icon: Icon(Icons.check, color: context.accentColor),
+            onPressed: _isSaving ? null : _save,
+            tooltip: 'Save',
+          ),
+        ],
+      ),
+      body: Stack(
+        children: [
+          _buildForm(),
+          if (_isLoading || _isSaving) _buildLoadingOverlay(),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildForm() {
+    return AutofillGroup(
+      child: SingleChildScrollView(
+      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 8),
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          _buildTitleField(),
+          const SizedBox(height: 16),
+          _buildField(
+            controller: _usernameController,
+            label: 'Username',
+            icon: Icons.person_outline,
+            autofillHints: const [AutofillHints.username],
+            suffix: _usernameController.text.isNotEmpty
+                ? IconButton(
+                    icon: Icon(Icons.copy, size: 18, color: context.textTertiary),
+                    onPressed: () =>
+                        _copyField(_usernameController.text, 'Username'),
+                    tooltip: 'Copy username',
+                  )
+                : null,
+          ),
+          const SizedBox(height: 16),
+          _buildPasswordField(),
+          const SizedBox(height: 16),
+          _buildField(
+            controller: _urlController,
+            label: 'URL',
+            icon: Icons.link,
+            keyboardType: TextInputType.url,
+            autofillHints: const [AutofillHints.url],
+          ),
+          const SizedBox(height: 16),
+          _buildField(
+            controller: _notesController,
+            label: 'Notes',
+            icon: Icons.note_outlined,
+            maxLines: 3,
+          ),
+          const SizedBox(height: 16),
+          _buildTagsSection(),
+          if (!isEditing) ...[
+            const SizedBox(height: 16),
+            _buildAlgorithmSection(),
+            const SizedBox(height: 16),
+            _buildKdfSection(),
+          ],
+          const SizedBox(height: 32),
+        ],
+      ),
+      ),
+    );
+  }
+
+  bool get isEditing => widget.entry != null;
+
+  Widget _buildTitleField() {
+    return TextField(
+      controller: _titleController,
+      style: TextStyle(
+        fontFamily: 'ProductSans',
+        fontSize: 22,
+        fontWeight: FontWeight.w600,
+        color: context.textPrimary,
+      ),
+      decoration: InputDecoration(
+        hintText: 'Title',
+        hintStyle: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 22,
+          fontWeight: FontWeight.w600,
+          color: context.textTertiary,
+        ),
+        border: InputBorder.none,
+        enabledBorder: InputBorder.none,
+        focusedBorder: InputBorder.none,
+      ),
+    );
+  }
+
+  Widget _buildField({
+    required TextEditingController controller,
+    required String label,
+    required IconData icon,
+    TextInputType? keyboardType,
+    int maxLines = 1,
+    Widget? suffix,
+    Iterable<String>? autofillHints,
+  }) {
+    return TextField(
+      controller: controller,
+      keyboardType: keyboardType,
+      maxLines: maxLines,
+      autofillHints: autofillHints,
+      style: TextStyle(
+        fontFamily: 'ProductSans',
+        fontSize: 15,
+        color: context.textPrimary,
+      ),
+      decoration: InputDecoration(
+        labelText: label,
+        labelStyle: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 14,
+          color: context.textTertiary,
+        ),
+        prefixIcon: Icon(icon, color: context.textTertiary, size: 20),
+        suffixIcon: suffix,
+        filled: true,
+        fillColor: context.surfaceColor,
+        border: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        enabledBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        focusedBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.accentColor, width: 2),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildPasswordField() {
+    return TextField(
+      controller: _passwordController,
+      obscureText: _obscurePassword,
+      keyboardType: TextInputType.visiblePassword,
+      autofillHints: [isEditing ? AutofillHints.password : AutofillHints.newPassword],
+      style: TextStyle(
+        fontFamily: 'ProductSans',
+        fontSize: 15,
+        color: context.textPrimary,
+      ),
+      decoration: InputDecoration(
+        labelText: 'Password',
+        labelStyle: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 14,
+          color: context.textTertiary,
+        ),
+        prefixIcon:
+            Icon(Icons.lock_outline, color: context.textTertiary, size: 20),
+        suffixIcon: Row(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            IconButton(
+              icon: Icon(
+                _obscurePassword
+                    ? Icons.visibility_outlined
+                    : Icons.visibility_off_outlined,
+                size: 18,
+                color: context.textTertiary,
+              ),
+              onPressed: () =>
+                  setState(() => _obscurePassword = !_obscurePassword),
+            ),
+            IconButton(
+              icon: Icon(Icons.auto_awesome, size: 18, color: context.accentColor),
+              onPressed: _showGenerator,
+              tooltip: 'Generate',
+            ),
+            if (_passwordController.text.isNotEmpty)
+              IconButton(
+                icon: Icon(Icons.copy, size: 18, color: context.textTertiary),
+                onPressed: () =>
+                    _copyField(_passwordController.text, 'Password'),
+              ),
+          ],
+        ),
+        filled: true,
+        fillColor: context.surfaceColor,
+        border: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        enabledBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        focusedBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.accentColor, width: 2),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildTagsSection() {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          'Tags',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textSecondary,
+          ),
+        ),
+        const SizedBox(height: 8),
+        if (_tags.isNotEmpty)
+          Wrap(
+            spacing: 6,
+            runSpacing: 6,
+            children: _tags.map((tag) {
+              return Chip(
+                label: Text(
+                  tag,
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 12,
+                    color: context.accentColor,
+                  ),
+                ),
+                backgroundColor: context.accentColor.withValues(alpha: 0.12),
+                side: BorderSide.none,
+                deleteIcon: Icon(Icons.close, size: 14, color: context.textTertiary),
+                onDeleted: () => setState(() => _tags.remove(tag)),
+              );
+            }).toList(),
+          ),
+        const SizedBox(height: 8),
+        Row(
+          children: [
+            Expanded(
+              child: TextField(
+                controller: _tagController,
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 14,
+                  color: context.textPrimary,
+                ),
+                decoration: InputDecoration(
+                  hintText: 'Add tag...',
+                  hintStyle: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 14,
+                    color: context.textTertiary,
+                  ),
+                  filled: true,
+                  fillColor: context.surfaceColor,
+                  isDense: true,
+                  border: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide(color: context.borderColor),
+                  ),
+                  enabledBorder: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide(color: context.borderColor),
+                  ),
+                  focusedBorder: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide(color: context.accentColor),
+                  ),
+                ),
+                onSubmitted: (_) => _addTag(),
+              ),
+            ),
+            const SizedBox(width: 8),
+            IconButton(
+              icon: Icon(Icons.add, color: context.accentColor),
+              onPressed: _addTag,
+            ),
+          ],
+        ),
+      ],
+    );
+  }
+
+  Widget _buildAlgorithmSection() {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          'Encryption',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textSecondary,
+          ),
+        ),
+        const SizedBox(height: 8),
+        Wrap(
+          spacing: 8,
+          children: EncryptionAlgorithm.values.map((alg) {
+            final selected = _algorithm == alg;
+            return ChoiceChip(
+              label: Text(alg.displayName),
+              selected: selected,
+              selectedColor: context.accentColor.withValues(alpha: 0.2),
+              labelStyle: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 13,
+                color: selected ? context.accentColor : context.textSecondary,
+              ),
+              side: BorderSide(
+                color: selected ? context.accentColor : context.borderColor,
+              ),
+              onSelected: (_) => setState(() => _algorithm = alg),
+            );
+          }).toList(),
+        ),
+      ],
+    );
+  }
+
+  Widget _buildKdfSection() {
+    const options = [100000, 200000, 500000];
+    const labels = ['100K', '200K', '500K'];
+
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          'Key Derivation Iterations',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textSecondary,
+          ),
+        ),
+        const SizedBox(height: 8),
+        Wrap(
+          spacing: 8,
+          children: List.generate(options.length, (i) {
+            final selected = _kdfIterations == options[i];
+            return ChoiceChip(
+              label: Text(labels[i]),
+              selected: selected,
+              selectedColor: context.accentColor.withValues(alpha: 0.2),
+              labelStyle: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 13,
+                color: selected ? context.accentColor : context.textSecondary,
+              ),
+              side: BorderSide(
+                color: selected ? context.accentColor : context.borderColor,
+              ),
+              onSelected: (_) => setState(() => _kdfIterations = options[i]),
+            );
+          }),
+        ),
+      ],
+    );
+  }
+
+  Widget _buildLoadingOverlay() {
+    return Positioned.fill(
+      child: Container(
+        color: context.backgroundColor.withValues(alpha: 0.7),
+        child: Center(
+          child: CircularProgressIndicator(
+            valueColor: AlwaysStoppedAnimation(context.accentColor),
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/lib/screens/password_list_screen.dart b/lib/screens/password_list_screen.dart
new file mode 100644
index 0000000..e09748c
--- /dev/null
+++ b/lib/screens/password_list_screen.dart
@@ -0,0 +1,460 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+import '../models/password_entry.dart';
+import '../providers/password_providers.dart';
+import '../themes/app_colors.dart';
+import '../utils/toast_utils.dart';
+import '../widgets/password_card.dart';
+import 'password_editor_screen.dart';
+
+class PasswordListScreen extends ConsumerStatefulWidget {
+  const PasswordListScreen({super.key});
+
+  @override
+  ConsumerState<PasswordListScreen> createState() =>
+      _PasswordListScreenState();
+}
+
+class _PasswordListScreenState extends ConsumerState<PasswordListScreen> {
+  final TextEditingController _searchController = TextEditingController();
+  final Set<String> _selectedIds = {};
+  bool _isSelectionMode = false;
+  bool _showAutofillInfo = false;
+
+  @override
+  void initState() {
+    super.initState();
+    _loadAutofillInfoState();
+  }
+
+  Future<void> _loadAutofillInfoState() async {
+    final prefs = await SharedPreferences.getInstance();
+    if (mounted) {
+      setState(() {
+        _showAutofillInfo =
+            !(prefs.getBool('autofill_info_dismissed') ?? false);
+      });
+    }
+  }
+
+  Future<void> _dismissAutofillInfo() async {
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.setBool('autofill_info_dismissed', true);
+    setState(() => _showAutofillInfo = false);
+  }
+
+  @override
+  void dispose() {
+    _searchController.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final searchQuery = ref.watch(passwordSearchQueryProvider);
+    final selectedTag = ref.watch(selectedPasswordTagProvider);
+    final entriesAsync = ref.watch(passwordsNotifierProvider);
+
+    return Scaffold(
+      backgroundColor: context.backgroundColor,
+      appBar: _isSelectionMode
+          ? _buildSelectionAppBar()
+          : AppBar(
+              backgroundColor: context.backgroundColor,
+              elevation: 0,
+              title: Text(
+                'Passwords',
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 20,
+                  fontWeight: FontWeight.w600,
+                  color: context.textPrimary,
+                ),
+              ),
+            ),
+      body: Column(
+        children: [
+          Padding(
+            padding: const EdgeInsets.all(16),
+            child: TextField(
+              controller: _searchController,
+              onChanged: (value) {
+                ref.read(passwordSearchQueryProvider.notifier).state = value;
+              },
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                color: context.textPrimary,
+              ),
+              decoration: InputDecoration(
+                hintText: 'Search passwords...',
+                hintStyle: TextStyle(
+                  fontFamily: 'ProductSans',
+                  color: context.textTertiary,
+                ),
+                prefixIcon: Icon(Icons.search, color: context.textTertiary),
+                filled: true,
+                fillColor: context.surfaceColor,
+                border: OutlineInputBorder(
+                  borderRadius: BorderRadius.circular(12),
+                  borderSide: BorderSide(color: context.borderColor),
+                ),
+                enabledBorder: OutlineInputBorder(
+                  borderRadius: BorderRadius.circular(12),
+                  borderSide: BorderSide(color: context.borderColor),
+                ),
+                focusedBorder: OutlineInputBorder(
+                  borderRadius: BorderRadius.circular(12),
+                  borderSide: BorderSide(color: context.accentColor),
+                ),
+              ),
+            ),
+          ),
+          if (_showAutofillInfo) _buildAutofillInfoCard(),
+          Expanded(
+            child: entriesAsync.when(
+              data: (entries) {
+                final allTags = _collectTags(entries);
+                final filtered =
+                    _filterPasswords(entries, searchQuery, selectedTag);
+                return Column(
+                  children: [
+                    if (allTags.isNotEmpty)
+                      SizedBox(
+                        height: 40,
+                        child: ListView(
+                          scrollDirection: Axis.horizontal,
+                          padding: const EdgeInsets.symmetric(horizontal: 16),
+                          children: [
+                            _buildTagChip(
+                              null,
+                              selectedTag == null,
+                              'All',
+                            ),
+                            ...allTags.map((tag) =>
+                                _buildTagChip(tag, selectedTag == tag, tag)),
+                          ],
+                        ),
+                      ),
+                    Expanded(
+                      child: filtered.isEmpty
+                          ? _buildEmptyState(searchQuery)
+                          : ListView.builder(
+                              padding: const EdgeInsets.all(16),
+                              itemCount: filtered.length,
+                              itemBuilder: (context, index) {
+                                final entry = filtered[index];
+                                final isSelected =
+                                    _selectedIds.contains(entry.id);
+                                return Padding(
+                                  padding:
+                                      const EdgeInsets.only(bottom: 10),
+                                  child: PasswordCard(
+                                    entry: entry,
+                                    isSelected: isSelected,
+                                    onTap: () {
+                                      if (_isSelectionMode) {
+                                        setState(() {
+                                          if (isSelected) {
+                                            _selectedIds.remove(entry.id);
+                                            if (_selectedIds.isEmpty) {
+                                              _isSelectionMode = false;
+                                            }
+                                          } else {
+                                            _selectedIds.add(entry.id);
+                                          }
+                                        });
+                                      } else {
+                                        Navigator.push(
+                                          context,
+                                          MaterialPageRoute(
+                                            builder: (_) =>
+                                                PasswordEditorScreen(
+                                                    entry: entry),
+                                          ),
+                                        );
+                                      }
+                                    },
+                                    onLongPress: () {
+                                      if (!_isSelectionMode) {
+                                        setState(() {
+                                          _isSelectionMode = true;
+                                          _selectedIds.add(entry.id);
+                                        });
+                                      }
+                                    },
+                                  ),
+                                );
+                              },
+                            ),
+                    ),
+                  ],
+                );
+              },
+              loading: () =>
+                  const Center(child: CircularProgressIndicator()),
+              error: (error, _) => Center(
+                child: Text(
+                  'Error loading passwords',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    color: context.textTertiary,
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+      floatingActionButton: _isSelectionMode
+          ? null
+          : FloatingActionButton(
+              onPressed: () => Navigator.push(
+                context,
+                MaterialPageRoute(
+                  builder: (_) => const PasswordEditorScreen(),
+                ),
+              ),
+              backgroundColor: context.accentColor,
+              child: const Icon(Icons.add, color: Colors.white),
+            ),
+    );
+  }
+
+  Widget _buildAutofillInfoCard() {
+    return Container(
+      margin: const EdgeInsets.fromLTRB(16, 0, 16, 12),
+      padding: const EdgeInsets.all(14),
+      decoration: BoxDecoration(
+        color: context.accentColor.withValues(alpha: 0.08),
+        borderRadius: BorderRadius.circular(12),
+        border: Border.all(
+          color: context.accentColor.withValues(alpha: 0.25),
+        ),
+      ),
+      child: Row(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Icon(Icons.auto_awesome, color: context.accentColor, size: 20),
+          const SizedBox(width: 10),
+          Expanded(
+            child: Column(
+              crossAxisAlignment: CrossAxisAlignment.start,
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                Text(
+                  'Autofill is available',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 14,
+                    fontWeight: FontWeight.w600,
+                    color: context.accentColor,
+                  ),
+                ),
+                const SizedBox(height: 6),
+                Text(
+                  'Enable in Android Settings to fill logins in any app:\n'
+                  'Settings → Passwords & accounts → Autofill service → Latch',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 12,
+                    color: context.textSecondary,
+                    height: 1.4,
+                  ),
+                ),
+              ],
+            ),
+          ),
+          IconButton(
+            icon: Icon(Icons.close, size: 16, color: context.textTertiary),
+            onPressed: _dismissAutofillInfo,
+            tooltip: 'Dismiss',
+            padding: EdgeInsets.zero,
+            constraints: const BoxConstraints(minWidth: 36, minHeight: 36),
+          ),
+        ],
+      ),
+    );
+  }
+
+  PreferredSizeWidget _buildSelectionAppBar() {
+    return AppBar(
+      backgroundColor: context.backgroundColor,
+      elevation: 0,
+      leading: IconButton(
+        icon: Icon(Icons.close, color: context.textPrimary),
+        onPressed: () {
+          setState(() {
+            _isSelectionMode = false;
+            _selectedIds.clear();
+          });
+        },
+      ),
+      title: Text(
+        '${_selectedIds.length} selected',
+        style: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 18,
+          fontWeight: FontWeight.w600,
+          color: context.textPrimary,
+        ),
+      ),
+      actions: [
+        IconButton(
+          icon: Icon(Icons.delete_outline, color: AppColors.error),
+          onPressed: _showDeleteConfirmation,
+        ),
+      ],
+    );
+  }
+
+  Widget _buildTagChip(String? tag, bool isSelected, String label) {
+    return Padding(
+      padding: const EdgeInsets.only(right: 8),
+      child: FilterChip(
+        label: Text(
+          label,
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 12,
+            color: isSelected
+                ? Colors.white
+                : context.textSecondary,
+          ),
+        ),
+        selected: isSelected,
+        onSelected: (_) {
+          ref.read(selectedPasswordTagProvider.notifier).state = tag;
+        },
+        selectedColor: context.accentColor,
+        backgroundColor: context.surfaceColor,
+        side: BorderSide(
+          color: isSelected ? context.accentColor : context.borderColor,
+        ),
+        visualDensity: VisualDensity.compact,
+      ),
+    );
+  }
+
+  Widget _buildEmptyState(String searchQuery) {
+    return Center(
+      child: Column(
+        mainAxisAlignment: MainAxisAlignment.center,
+        children: [
+          Icon(
+            Icons.lock_outline,
+            size: 64,
+            color: context.textTertiary,
+          ),
+          const SizedBox(height: 16),
+          Text(
+            searchQuery.isNotEmpty
+                ? 'No passwords found'
+                : 'No passwords yet',
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 16,
+              color: context.textTertiary,
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  List<String> _collectTags(List<PasswordEntry> entries) {
+    final tags = <String>{};
+    for (final entry in entries) {
+      tags.addAll(entry.tags);
+    }
+    return tags.toList()..sort();
+  }
+
+  List<PasswordEntry> _filterPasswords(
+    List<PasswordEntry> entries,
+    String searchQuery,
+    String? selectedTag,
+  ) {
+    var filtered = entries;
+    if (selectedTag != null) {
+      filtered = filtered.where((e) => e.hasTag(selectedTag)).toList();
+    }
+    if (searchQuery.isNotEmpty) {
+      final query = searchQuery.toLowerCase();
+      filtered = filtered
+          .where((e) =>
+              e.title.toLowerCase().contains(query) ||
+              e.tags.any((t) => t.contains(query)))
+          .toList();
+    }
+    filtered.sort((a, b) {
+      if (a.isFavorite && !b.isFavorite) return -1;
+      if (!a.isFavorite && b.isFavorite) return 1;
+      return b.updatedAt.compareTo(a.updatedAt);
+    });
+    return filtered;
+  }
+
+  Future<void> _showDeleteConfirmation() async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (context) => AlertDialog(
+        backgroundColor: context.surfaceColor,
+        title: Text(
+          'Delete Passwords',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontWeight: FontWeight.w600,
+            color: context.textPrimary,
+          ),
+        ),
+        content: Text(
+          'Delete ${_selectedIds.length} entry(s)? This cannot be undone.',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            color: context.textSecondary,
+          ),
+        ),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.pop(context, false),
+            child: Text(
+              'Cancel',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                color: context.textSecondary,
+              ),
+            ),
+          ),
+          TextButton(
+            onPressed: () => Navigator.pop(context, true),
+            child: Text(
+              'Delete',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                color: AppColors.error,
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+
+    if (confirmed == true && mounted) {
+      final entriesAsync = ref.read(passwordsNotifierProvider);
+      entriesAsync.whenData((entries) async {
+        final toDelete =
+            entries.where((e) => _selectedIds.contains(e.id)).toList();
+        await ref.read(passwordsNotifierProvider.notifier).deletePasswords(toDelete);
+        if (mounted) {
+          setState(() {
+            _isSelectionMode = false;
+            _selectedIds.clear();
+          });
+          ToastUtils.showSuccess('Passwords deleted');
+        }
+      });
+    }
+  }
+}
diff --git a/lib/screens/password_setup_screen.dart b/lib/screens/password_setup_screen.dart
index 4a4ee59..ba602ec 100644
--- a/lib/screens/password_setup_screen.dart
+++ b/lib/screens/password_setup_screen.dart
@@ -33,9 +33,10 @@ class _PasswordSetupScreenState extends State<PasswordSetupScreen> {
   Future<void> _handleContinue() async {
     final password = _passwordController.text;
 
-    if (password.isEmpty) {
+    final strength = AuthService.validatePasswordStrength(password);
+    if (strength.isBlocking) {
       setState(() {
-        _errorMessage = 'Please enter a password';
+        _errorMessage = strength.label;
       });
       return;
     }
diff --git a/lib/screens/re_encrypt_file_picker_screen.dart b/lib/screens/re_encrypt_file_picker_screen.dart
index f308a0d..9e1a5fa 100644
--- a/lib/screens/re_encrypt_file_picker_screen.dart
+++ b/lib/screens/re_encrypt_file_picker_screen.dart
@@ -55,7 +55,7 @@ class _ReEncryptFilePickerScreenState
 
   @override
   Widget build(BuildContext context) {
-    final filesAsync = ref.watch(allFilesProvider);
+    final filesAsync = ref.watch(vaultNotifierProvider);
     final reEncryptProgress = ref.watch(reEncryptProvider);
 
     return Scaffold(
@@ -334,7 +334,7 @@ class _ReEncryptFilePickerScreenState
   }
 
   Future<void> _startReEncrypt() async {
-    final encryptedFiles = _encryptedFiles(ref.read(allFilesProvider));
+    final encryptedFiles = _encryptedFiles(ref.read(vaultNotifierProvider));
     final largeFiles = encryptedFiles
         .where((f) => _selectedIds.contains(f.id) && f.fileSize > _largeFileThresholdBytes)
         .toList();
@@ -435,7 +435,7 @@ class _ReEncryptFilePickerScreenState
           ),
         ),
       );
-      ref.invalidate(allFilesProvider);
+      ref.invalidate(vaultNotifierProvider);
     }
   }
 }
diff --git a/lib/screens/song_player_screen.dart b/lib/screens/song_player_screen.dart
index 3e2c7ab..89794f9 100644
--- a/lib/screens/song_player_screen.dart
+++ b/lib/screens/song_player_screen.dart
@@ -5,7 +5,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter/services.dart';
 import 'package:just_audio/just_audio.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 
 import '../models/vaulted_file.dart';
 import '../services/flick_integration_service.dart';
@@ -175,15 +175,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
@@ -306,12 +298,14 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
         actions: [
           IconButton(
             onPressed: _toggleFavorite,
+            tooltip: 'Favorite',
             icon: Icon(
               widget.file.isFavorite ? Icons.favorite : Icons.favorite_border,
               color: widget.file.isFavorite ? Colors.red : context.textPrimary,
             ),
           ),
           PopupMenuButton<String>(
+            tooltip: 'More options',
             icon: Icon(Icons.more_vert, color: context.textPrimary),
             onSelected: (value) {
               switch (value) {
@@ -483,6 +477,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
                               ? () =>
                                   _seek(position - const Duration(seconds: 10))
                               : () => _seek(Duration.zero),
+                          tooltip: 'Back 10 seconds',
                           icon: Icon(
                             Icons.replay_10,
                             color: context.textPrimary,
@@ -503,6 +498,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
                                     processingState == ProcessingState.buffering
                                 ? null
                                 : _togglePlayback,
+                            tooltip: isPlaying ? 'Pause' : 'Play',
                             icon: Icon(
                               isPlaying ? Icons.pause : Icons.play_arrow,
                               color: Colors.white,
@@ -516,6 +512,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
                               ? () =>
                                   _seek(position + const Duration(seconds: 10))
                               : null,
+                          tooltip: 'Forward 10 seconds',
                           icon: Icon(
                             Icons.forward_10,
                             color: context.textPrimary,
diff --git a/lib/screens/tags_screen.dart b/lib/screens/tags_screen.dart
index 3a2fb89..a6828c2 100644
--- a/lib/screens/tags_screen.dart
+++ b/lib/screens/tags_screen.dart
@@ -3,7 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:locker/models/album.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
 import '../services/auto_kill_service.dart';
@@ -491,20 +491,12 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
   Widget _buildFileThumbnail(VaultedFile file) {
     if (file.isImage) {
       final imageFile = File(file.vaultPath);
-      return FutureBuilder<bool>(
-        future: imageFile.exists(),
-        builder: (context, snapshot) {
-          if (snapshot.data != true) {
-            return _buildPlaceholder(file);
-          }
-          return Image.file(
-            imageFile,
-            fit: BoxFit.cover,
-            cacheWidth: 300,
-            filterQuality: FilterQuality.low,
-            errorBuilder: (_, __, ___) => _buildPlaceholder(file),
-          );
-        },
+      return Image.file(
+        imageFile,
+        fit: BoxFit.cover,
+        cacheWidth: 300,
+        filterQuality: FilterQuality.low,
+        errorBuilder: (_, __, ___) => _buildPlaceholder(file),
       );
     }
 
@@ -525,31 +517,8 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
   }
 
   Widget _buildPlaceholder(VaultedFile file) {
-    IconData icon;
-    Color color;
-
-    switch (file.type) {
-      case VaultedFileType.image:
-        icon = Icons.image;
-        color = context.accentColor;
-        break;
-      case VaultedFileType.video:
-        icon = Icons.videocam;
-        color = Colors.red;
-        break;
-      case VaultedFileType.song:
-        icon = Icons.music_note;
-        color = Colors.purple;
-        break;
-      case VaultedFileType.document:
-        icon = Icons.description;
-        color = Colors.orange;
-        break;
-      case VaultedFileType.other:
-        icon = Icons.insert_drive_file;
-        color = Colors.grey;
-        break;
-    }
+    final color = FileTypeColors.colorForType(file.type, accent: context.accentColor);
+    final icon = FileTypeColors.iconForType(file.type);
 
     return Container(
       color: color.withValues(alpha: 0.1),
@@ -794,15 +763,7 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
@@ -998,7 +959,7 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
           ],
         ),
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showTagOptions(TagInfo tag) {
diff --git a/lib/screens/unlock_screen.dart b/lib/screens/unlock_screen.dart
index 2d8a41d..8d4d2e3 100644
--- a/lib/screens/unlock_screen.dart
+++ b/lib/screens/unlock_screen.dart
@@ -4,6 +4,7 @@ import 'package:flutter/material.dart';
 import '../themes/app_colors.dart';
 import '../services/auth_service.dart';
 import '../services/decoy_service.dart';
+import '../services/encryption_service.dart';
 import '../widgets/adaptive_logo.dart';
 import '../widgets/pin_input_widget.dart';
 import 'gallery_vault_screen.dart';
@@ -124,6 +125,13 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final result = await _decoyService.checkIfDecoyCredential(credential);
     if (!result.isDecoy) return false;
 
+    try {
+      await EncryptionService.instance.unlockMasterKey(credential, isDecoy: true);
+    } catch (e) {
+      debugPrint('Decoy key unlock failed: $e');
+      return false;
+    }
+
     await _openVault(isDecoy: true);
     return true;
   }
@@ -159,7 +167,14 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final isValid = await _authService.verifyPIN(pin);
 
     if (isValid && mounted) {
-      await _openVault(isDecoy: false);
+      try {
+        await EncryptionService.instance.unlockMasterKey(pin);
+        await _openVault(isDecoy: false);
+      } catch (e) {
+        debugPrint('Master key unlock failed: $e');
+        await _handleFailedUnlock('Incorrect PIN.');
+        _pinController.clear();
+      }
     } else if (mounted) {
       await _handleFailedUnlock('Incorrect PIN.');
       _pinController.clear();
@@ -204,7 +219,14 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final isValid = await _authService.verifyPassword(password);
 
     if (isValid && mounted) {
-      await _openVault(isDecoy: false);
+      try {
+        await EncryptionService.instance.unlockMasterKey(password);
+        await _openVault(isDecoy: false);
+      } catch (e) {
+        debugPrint('Master key unlock failed: $e');
+        await _handleFailedUnlock('Incorrect password.');
+        _passwordController.clear();
+      }
     } else if (mounted) {
       await _handleFailedUnlock('Incorrect password.');
       _passwordController.clear();
@@ -231,7 +253,16 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final result = await _authService.performBiometricAuthentication();
 
     if (result.isSuccess && mounted) {
-      await _openVault(isDecoy: false);
+      try {
+        await EncryptionService.instance.unlockMasterKeyWithBiometric();
+        await _openVault(isDecoy: false);
+      } catch (e) {
+        debugPrint('Biometric key unlock failed: $e');
+        setState(() {
+          _errorMessage = 'Unable to unlock vault. Please use your backup credential.';
+          _isAuthenticating = false;
+        });
+      }
     } else if (mounted) {
       if (countFailure && result.shouldCountAsFailedUnlock) {
         await _handleFailedUnlock('Biometric authentication failed.');
diff --git a/lib/screens/vault_explorer_screen.dart b/lib/screens/vault_explorer_screen.dart
index f1ca876..11a28aa 100644
--- a/lib/screens/vault_explorer_screen.dart
+++ b/lib/screens/vault_explorer_screen.dart
@@ -1,8 +1,7 @@
-import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/album.dart';
 import '../models/vault_folder.dart';
 import '../models/vaulted_file.dart';
@@ -18,6 +17,7 @@ import '../widgets/explorer_toolbar.dart';
 import '../widgets/operation_progress_sheet.dart';
 import '../widgets/media_multi_select_action_sheet.dart';
 import 'note_list_screen.dart';
+import 'password_list_screen.dart';
 
 class VaultExplorerScreen extends ConsumerStatefulWidget {
   const VaultExplorerScreen({super.key});
@@ -110,6 +110,16 @@ class _VaultExplorerScreenState extends ConsumerState<VaultExplorerScreen> {
             );
           },
         ),
+        IconButton(
+          icon: Icon(Icons.password, color: context.textSecondary),
+          tooltip: 'Passwords',
+          onPressed: () {
+            Navigator.push(
+              context,
+              MaterialPageRoute(builder: (_) => const PasswordListScreen()),
+            );
+          },
+        ),
       ],
     );
   }
@@ -279,15 +289,7 @@ class _VaultExplorerScreenState extends ConsumerState<VaultExplorerScreen> {
 
   Future<void> _exportFileToDownloads(VaultedFile file) async {
     try {
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         ToastUtils.showError('Could not access Downloads folder');
diff --git a/lib/services/auth_service.dart b/lib/services/auth_service.dart
index 75667ab..04ecd13 100644
--- a/lib/services/auth_service.dart
+++ b/lib/services/auth_service.dart
@@ -8,15 +8,17 @@ import 'package:local_auth/local_auth.dart';
 import 'package:local_auth_android/local_auth_android.dart';
 import 'package:local_auth_darwin/local_auth_darwin.dart';
 import '../utils/pbkdf2_isolate.dart';
+import '../utils/secure_compare.dart';
 import 'auto_kill_service.dart';
 import 'decoy_service.dart';
+import 'encryption_service.dart';
 import 'vault_service.dart';
 
 /// Authentication service that handles password and biometric authentication
 class AuthService {
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _passwordHashKey = 'user_password_hash';
@@ -58,11 +60,12 @@ class AuthService {
   /// Create and store the user's password
   Future<bool> createPassword(String password) async {
     try {
-      if (password.isEmpty) return false;
+      if (password.length < minPasswordLength) return false;
 
       await _createHashedCredential(password, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _firstTimeKey, value: 'false');
       await _storage.write(key: _authMethodKey, value: 'password');
+      EncryptionService.instance.setPendingCredential(password);
 
       return true;
     } catch (e) {
@@ -80,6 +83,7 @@ class AuthService {
       await _createHashedCredential(pin, _pinSaltKey, _pinHashKey, _pinIterationsKey);
       await _storage.write(key: _firstTimeKey, value: 'false');
       await _storage.write(key: _authMethodKey, value: 'pin');
+      EncryptionService.instance.setPendingCredential(pin);
 
       return true;
     } catch (e) {
@@ -89,12 +93,18 @@ class AuthService {
 
   /// Verify the provided PIN against stored hash
   Future<bool> verifyPIN(String pin) async {
-    if (await _verifyCredential(pin, _pinHashKey, _pinSaltKey, _pinIterationsKey)) return true;
+    if (await _verifyCredential(pin, _pinHashKey, _pinSaltKey, _pinIterationsKey)) {
+      EncryptionService.instance.setPendingCredential(pin);
+      return true;
+    }
     return _verifyCredential(pin, _backupPinHashKey, _backupPinSaltKey, _backupPinIterationsKey);
   }
 
   Future<bool> verifyPassword(String password) async {
-    if (await _verifyCredential(password, _passwordHashKey, _passwordSaltKey, _passwordIterationsKey)) return true;
+    if (await _verifyCredential(password, _passwordHashKey, _passwordSaltKey, _passwordIterationsKey)) {
+      EncryptionService.instance.setPendingCredential(password);
+      return true;
+    }
     return _verifyCredential(password, _backupPasswordHashKey, _backupPasswordSaltKey, _backupPasswordIterationsKey);
   }
 
@@ -311,6 +321,7 @@ class AuthService {
 
         await _storage.write(key: _firstTimeKey, value: 'false');
         await _storage.write(key: _authMethodKey, value: 'biometric');
+        await EncryptionService.instance.setupBiometricKwk();
         debugPrint('[AuthService] Biometric setup complete');
         return true;
       }
@@ -370,7 +381,7 @@ class AuthService {
   Future<bool> changePassword(
       String currentPassword, String newPassword) async {
     try {
-      if (currentPassword.isEmpty || newPassword.isEmpty) return false;
+      if (currentPassword.isEmpty || newPassword.length < minPasswordLength) return false;
 
       final isVerified = await verifyPassword(currentPassword);
       if (!isVerified) return false;
@@ -378,6 +389,9 @@ class AuthService {
       await _createHashedCredential(newPassword, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'password');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPassword);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -398,6 +412,9 @@ class AuthService {
       await _createHashedCredential(newPIN, _pinSaltKey, _pinHashKey, _pinIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'pin');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPIN);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -409,7 +426,7 @@ class AuthService {
   Future<bool> switchFromPINToPassword(
       String currentPIN, String newPassword) async {
     try {
-      if (currentPIN.isEmpty || newPassword.isEmpty) return false;
+      if (currentPIN.isEmpty || newPassword.length < minPasswordLength) return false;
 
       final isVerified = await verifyPIN(currentPIN);
       if (!isVerified) return false;
@@ -417,6 +434,9 @@ class AuthService {
       await _createHashedCredential(newPassword, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'password');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPassword);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -438,6 +458,9 @@ class AuthService {
       await _createHashedCredential(newPIN, _pinSaltKey, _pinHashKey, _pinIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'pin');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPIN);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -452,25 +475,28 @@ class AuthService {
       await _storage.delete(key: _pinHashKey);
       await _storage.delete(key: _passwordSaltKey);
       await _storage.delete(key: _pinSaltKey);
-      await _storage.delete(key: _backupPasswordHashKey);
-      await _storage.delete(key: _backupPinHashKey);
-      await _storage.delete(key: _backupPasswordSaltKey);
-      await _storage.delete(key: _backupPinSaltKey);
-      await _storage.delete(key: _passwordIterationsKey);
-      await _storage.delete(key: _pinIterationsKey);
-      await _storage.delete(key: _backupPasswordIterationsKey);
-      await _storage.delete(key: _backupPinIterationsKey);
+      await _clearBackupCredentials();
       await _storage.delete(key: _hashVersionKey);
       await _storage.delete(key: _firstTimeKey);
       await _storage.delete(key: _biometricsEnabledKey);
       await _storage.delete(key: _authMethodKey);
       await resetUnlockAttempts();
+      await EncryptionService.instance.removeBiometricKwk();
       return true;
     } catch (e) {
       return false;
     }
   }
 
+  Future<void> _clearBackupCredentials() async {
+    await _storage.delete(key: _backupPasswordHashKey);
+    await _storage.delete(key: _backupPinHashKey);
+    await _storage.delete(key: _backupPasswordSaltKey);
+    await _storage.delete(key: _backupPinSaltKey);
+    await _storage.delete(key: _backupPasswordIterationsKey);
+    await _storage.delete(key: _backupPinIterationsKey);
+  }
+
   /// Get the current unlock protection state.
   Future<UnlockSecurityState> getUnlockSecurityState() async {
     final settings = await _vaultService.getSettings();
@@ -543,9 +569,26 @@ class AuthService {
     );
   }
 
-  static const int _defaultKdfIterations = 100000;
+  static const int _defaultKdfIterations = 600000;
   static const int _saltSize = 32;
 
+  /// Minimum password length enforced at every entry point (setup, change).
+  static const int minPasswordLength = 8;
+
+  /// Classify a password's strength. Length is a hard floor; composition only
+  /// informs the warning level (NIST 800-63B: length over forced composition).
+  static PasswordStrength validatePasswordStrength(String password) {
+    if (password.length < minPasswordLength) return PasswordStrength.tooShort;
+    var classes = 0;
+    if (RegExp(r'[a-z]').hasMatch(password)) classes++;
+    if (RegExp(r'[A-Z]').hasMatch(password)) classes++;
+    if (RegExp(r'[0-9]').hasMatch(password)) classes++;
+    if (RegExp(r'[^a-zA-Z0-9]').hasMatch(password)) classes++;
+    // A long passphrase is fine even with one class; only flag short+mono.
+    if (password.length < 12 && classes < 2) return PasswordStrength.weak;
+    return PasswordStrength.acceptable;
+  }
+
   Future<int> _getCurrentKdfIterations() async {
     final settings = await _vaultService.getSettings();
     return settings.kdfIterations;
@@ -576,6 +619,9 @@ class AuthService {
 
   Future<bool> _verifyCredential(String credential, String hashKey, String saltKey, String iterationsKey) async {
     try {
+      final state = await getUnlockSecurityState();
+      if (state.isLockedOut) return false;
+
       final storedHash = await _storage.read(key: hashKey);
       final storedSalt = await _storage.read(key: saltKey);
 
@@ -583,7 +629,11 @@ class AuthService {
 
       if (storedSalt == null) {
         final legacyHash = _hashCredentialLegacy(credential);
-        if (legacyHash == storedHash) {
+        // Pad the legacy path with dummy KDF work so verify time does not
+        // reveal that this is a legacy (plain SHA-256) account.
+        await computePbkdf2Hash(
+            credential, _generateSalt(), iterations: _defaultKdfIterations);
+        if (constantTimeEquals(legacyHash, storedHash)) {
           final salt = _generateSalt();
           final iterations = await _getCurrentKdfIterations();
           final newHash = await computePbkdf2Hash(credential, salt, iterations: iterations);
@@ -602,7 +652,7 @@ class AuthService {
 
       final salt = base64Decode(storedSalt);
       final computedHash = await computePbkdf2Hash(credential, salt, iterations: storedIterations);
-      if (computedHash != storedHash) return false;
+      if (!constantTimeEquals(computedHash, storedHash)) return false;
 
       final currentIterations = await _getCurrentKdfIterations();
       if (currentIterations != storedIterations) {
@@ -723,6 +773,26 @@ enum BiometricAuthenticationStatus {
   unavailable,
 }
 
+/// Strength classification for a candidate password.
+enum PasswordStrength {
+  tooShort,
+  weak,
+  acceptable;
+
+  bool get isBlocking => this == tooShort;
+
+  String get label {
+    switch (this) {
+      case PasswordStrength.tooShort:
+        return 'Use at least $AuthService.minPasswordLength characters';
+      case PasswordStrength.weak:
+        return 'Weak — add length or a mix of letters, numbers, symbols';
+      case PasswordStrength.acceptable:
+        return 'Acceptable';
+    }
+  }
+}
+
 class BiometricAuthenticationResult {
   final BiometricAuthenticationStatus status;
 
diff --git a/lib/services/backup_service.dart b/lib/services/backup_service.dart
index 2947e8e..b7ddae5 100644
--- a/lib/services/backup_service.dart
+++ b/lib/services/backup_service.dart
@@ -1,6 +1,7 @@
 import 'dart:io';
 import 'package:archive/archive_io.dart';
 import 'package:flutter/foundation.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:path_provider/path_provider.dart';
 import 'package:uuid/uuid.dart';
 import '../models/vaulted_file.dart';
@@ -26,9 +27,12 @@ class BackupService {
 
   static final BackupService instance = BackupService._();
   final VaultService _vaultService;
+  final FlutterSecureStorage _secureStorage = const FlutterSecureStorage();
 
   static const String _zipPrefix = 'locker_';
   static const String _zipSuffix = '.zip';
+  static const String _passwordIndexKey = 'locker_passwords_index';
+  static const String _passwordIndexEntry = '_passwords_index.json';
 
   /// Map file type to ZIP subdir name (images/videos/documents).
   String _subdirForType(VaultedFileType type) {
@@ -113,6 +117,17 @@ class BackupService {
           onProgress?.call(current, total);
         }
 
+        final passwordIndex =
+            await _secureStorage.read(key: _passwordIndexKey);
+        if (passwordIndex != null && passwordIndex.isNotEmpty) {
+          final indexFile = File('${workDir.path}/$_passwordIndexEntry');
+          await indexFile.writeAsString(passwordIndex);
+          await encoder.addFile(indexFile, _passwordIndexEntry);
+          try {
+            await indexFile.delete();
+          } catch (_) {}
+        }
+
         await encoder.close();
         return BackupResult(success: true, zipPath: zipPath);
       } finally {
diff --git a/lib/services/decoy_service.dart b/lib/services/decoy_service.dart
index 217ad28..0fa6d47 100644
--- a/lib/services/decoy_service.dart
+++ b/lib/services/decoy_service.dart
@@ -4,7 +4,9 @@ import 'package:crypto/crypto.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import '../utils/pbkdf2_isolate.dart';
+import '../utils/secure_compare.dart';
 import '../models/vaulted_file.dart';
+import 'encryption_service.dart';
 import 'vault_service.dart';
 
 /// Service for managing decoy mode functionality
@@ -15,7 +17,7 @@ class DecoyService {
 
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _decoyEnabledKey = 'decoy_mode_enabled';
@@ -115,12 +117,14 @@ class DecoyService {
     }
   }
 
-  /// Set decoy PIN
+  /// Set decoy PIN (6 digits, matching main PIN requirement)
   Future<bool> setDecoyPin(String pin) async {
     try {
-      if (pin.isEmpty || pin.length < 4) return false;
+      if (pin.isEmpty || pin.length != 6) return false;
+      if (!RegExp(r'^[0-9]{6}$').hasMatch(pin)) return false;
 
       await _createHashedCredential(pin, _decoyPinSaltKey, _decoyPinKey, _decoyPinIterationsKey);
+      EncryptionService.instance.setPendingCredential(pin, isDecoy: true);
 
       _cachedSettings = (_cachedSettings ?? const DecoySettings()).copyWith(
         hasPinSet: true,
@@ -140,6 +144,7 @@ class DecoyService {
       if (password.isEmpty) return false;
 
       await _createHashedCredential(password, _decoyPasswordSaltKey, _decoyPasswordKey, _decoyPasswordIterationsKey);
+      EncryptionService.instance.setPendingCredential(password, isDecoy: true);
 
       _cachedSettings = (_cachedSettings ?? const DecoySettings()).copyWith(
         hasPasswordSet: true,
@@ -155,12 +160,16 @@ class DecoyService {
 
   /// Verify decoy PIN
   Future<bool> verifyDecoyPin(String pin) async {
-    return _verifyCredential(pin, _decoyPinKey, _decoyPinSaltKey, _decoyPinIterationsKey);
+    final result = await _verifyCredential(pin, _decoyPinKey, _decoyPinSaltKey, _decoyPinIterationsKey);
+    if (result) EncryptionService.instance.setPendingCredential(pin, isDecoy: true);
+    return result;
   }
 
   /// Verify decoy password
   Future<bool> verifyDecoyPassword(String password) async {
-    return _verifyCredential(password, _decoyPasswordKey, _decoyPasswordSaltKey, _decoyPasswordIterationsKey);
+    final result = await _verifyCredential(password, _decoyPasswordKey, _decoyPasswordSaltKey, _decoyPasswordIterationsKey);
+    if (result) EncryptionService.instance.setPendingCredential(password, isDecoy: true);
+    return result;
   }
 
   /// Check if input is decoy credential
@@ -235,7 +244,7 @@ class DecoyService {
     await _saveSettings();
   }
 
-  static const int _defaultKdfIterations = 100000;
+  static const int _defaultKdfIterations = 600000;
 
   Future<int> _getCurrentKdfIterations() async {
     final settings = await _vaultService.getSettings();
@@ -274,7 +283,11 @@ class DecoyService {
 
       if (storedSalt == null) {
         final legacyHash = _hashCredentialLegacy(credential);
-        if (legacyHash == storedHash) {
+        // Pad the legacy path with dummy KDF work so verify time does not
+        // reveal that this is a legacy (plain SHA-256) account.
+        await computePbkdf2Hash(
+            credential, _generateSalt(), iterations: _defaultKdfIterations);
+        if (constantTimeEquals(legacyHash, storedHash)) {
           final salt = _generateSalt();
           final iterations = await _getCurrentKdfIterations();
           final newHash = await computePbkdf2Hash(credential, salt, iterations: iterations);
@@ -293,7 +306,7 @@ class DecoyService {
 
       final salt = base64Decode(storedSalt);
       final computedHash = await computePbkdf2Hash(credential, salt, iterations: storedIterations);
-      if (computedHash != storedHash) return false;
+      if (!constantTimeEquals(computedHash, storedHash)) return false;
 
       final currentIterations = await _getCurrentKdfIterations();
       if (currentIterations != storedIterations) {
@@ -342,6 +355,11 @@ class DecoyService {
       await _storage.delete(key: _decoyPasswordSaltKey);
       await _storage.delete(key: _decoyPinIterationsKey);
       await _storage.delete(key: _decoyPasswordIterationsKey);
+      await _storage.delete(key: 'vault_decoy_key_version');
+      await _storage.delete(key: 'vault_decoy_key_wrapped');
+      await _storage.delete(key: 'vault_decoy_kwk_salt');
+      await _storage.delete(key: 'vault_decoy_kwk_iv');
+      await _storage.delete(key: 'vault_decoy_key');
       _cachedSettings = (_cachedSettings ?? const DecoySettings()).copyWith(
         hasPinSet: false,
         hasPasswordSet: false,
diff --git a/lib/services/encryption_service.dart b/lib/services/encryption_service.dart
index 627fe81..91a60f6 100644
--- a/lib/services/encryption_service.dart
+++ b/lib/services/encryption_service.dart
@@ -5,8 +5,10 @@ import 'dart:math';
 import 'package:crypto/crypto.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:path_provider/path_provider.dart';
 import 'package:pointycastle/export.dart';
 import '../models/encryption_algorithm.dart';
+import '../utils/argon2_isolate.dart';
 import 'crypto_isolate_pool.dart';
 
 const int _streamChunkSize = 1024 * 1024;
@@ -29,21 +31,42 @@ class EncryptionService {
   // migrateOnAlgorithmChange ensures existing data is automatically migrated
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _masterKeyKey = 'vault_master_key';
   static const String _decoyKeyKey = 'vault_decoy_key';
+
+  // H1: Key wrapping storage keys (real vault)
+  static const String _keyVersionKey = 'vault_key_version';
+  static const String _wrappedKeyKey = 'vault_master_key_wrapped';
+  static const String _kwkSaltKey = 'vault_kwk_salt';
+  static const String _kwkIvKey = 'vault_kwk_iv';
+  static const String _biometricKwkKey = 'vault_biometric_kwk';
+  static const String _biometricWrappedKeyKey = 'vault_master_key_wrapped_biometric';
+  static const String _biometricIvKey = 'vault_biometric_iv';
+
+  // H1: Key wrapping storage keys (decoy vault)
+  static const String _decoyKeyVersionKey = 'vault_decoy_key_version';
+  static const String _decoyWrappedKeyKey = 'vault_decoy_key_wrapped';
+  static const String _decoyKwkSaltKey = 'vault_decoy_kwk_salt';
+  static const String _decoyKwkIvKey = 'vault_decoy_kwk_iv';
+
   static const int _keySize = 32; // 256 bits
   static const int _ivSize = 16; // 128 bits
 
   Uint8List? _cachedMasterKey;
   Uint8List? _cachedDecoyKey;
+  String? _pendingCredential;
+  String? _pendingDecoyCredential;
 
   CryptoIsolatePool? _pool;
 
   Future<void> initialize() async {
-    await _ensureMasterKey();
+    final version = await _storage.read(key: _keyVersionKey);
+    if (version == null) {
+      await _ensureMasterKey();
+    }
     _pool = CryptoIsolatePool();
     await _pool!.initialize();
     await _checkKeyRotationRecovery();
@@ -54,10 +77,209 @@ class EncryptionService {
     _pool = null;
   }
 
+  /// Set pending credential for key unlocking (called by AuthService after verify/create)
+  void setPendingCredential(String credential, {bool isDecoy = false}) {
+    if (isDecoy) {
+      _pendingDecoyCredential = credential;
+    } else {
+      _pendingCredential = credential;
+    }
+  }
+
+  /// Unlock master key using user credential (PIN/password).
+  /// Handles first-time key creation, legacy migration, and normal unwrap.
+  Future<Uint8List> unlockMasterKey(String credential, {bool isDecoy = false}) async {
+    final cached = isDecoy ? _cachedDecoyKey : _cachedMasterKey;
+    if (cached != null) return cached;
+
+    final versionKey = isDecoy ? _decoyKeyVersionKey : _keyVersionKey;
+    final rawKeyKey = isDecoy ? _decoyKeyKey : _masterKeyKey;
+    final wrappedKeyKey = isDecoy ? _decoyWrappedKeyKey : _wrappedKeyKey;
+    final saltKey = isDecoy ? _decoyKwkSaltKey : _kwkSaltKey;
+    final ivKey = isDecoy ? _decoyKwkIvKey : _kwkIvKey;
+
+    final version = await _storage.read(key: versionKey);
+
+    if (version == '1') {
+      final wrappedKeyB64 = await _storage.read(key: wrappedKeyKey);
+      final saltB64 = await _storage.read(key: saltKey);
+      final ivB64 = await _storage.read(key: ivKey);
+
+      if (wrappedKeyB64 == null || saltB64 == null || ivB64 == null) {
+        throw StateError('Wrapped key data incomplete');
+      }
+
+      final kwk = await computeArgon2idHash(credential, base64Decode(saltB64));
+      final masterKey = _unwrapKey(base64Decode(wrappedKeyB64), kwk, base64Decode(ivB64));
+
+      if (isDecoy) {
+        _cachedDecoyKey = masterKey;
+      } else {
+        _cachedMasterKey = masterKey;
+      }
+      return masterKey;
+    }
+
+    // Legacy: read raw key, wrap with credential, delete raw (transparent migration)
+    final rawKeyB64 = await _storage.read(key: rawKeyKey);
+    if (rawKeyB64 != null) {
+      final masterKey = base64Decode(rawKeyB64);
+      await _wrapAndStoreKey(masterKey, credential, isDecoy: isDecoy);
+      await _storage.delete(key: rawKeyKey);
+      await _storage.write(key: versionKey, value: '1');
+
+      if (isDecoy) {
+        _cachedDecoyKey = masterKey;
+      } else {
+        _cachedMasterKey = masterKey;
+      }
+      debugPrint('[Encryption] Migrated ${isDecoy ? 'decoy' : 'master'} key to wrapped form');
+      return masterKey;
+    }
+
+    // First-time: generate new key, wrap, store
+    final masterKey = _generateRandomBytes(_keySize);
+    await _wrapAndStoreKey(masterKey, credential, isDecoy: isDecoy);
+    await _storage.write(key: versionKey, value: '1');
+
+    if (isDecoy) {
+      _cachedDecoyKey = masterKey;
+    } else {
+      _cachedMasterKey = masterKey;
+    }
+    return masterKey;
+  }
+
+  /// Unlock master key using biometric KWK (stored in secure storage).
+  Future<Uint8List> unlockMasterKeyWithBiometric({bool isDecoy = false}) async {
+    if (isDecoy) throw StateError('Decoy biometric unlock not supported');
+    if (_cachedMasterKey != null) return _cachedMasterKey!;
+
+    final version = await _storage.read(key: _keyVersionKey);
+
+    if (version == '1') {
+      final biometricKwkB64 = await _storage.read(key: _biometricKwkKey);
+      final wrappedKeyB64 = await _storage.read(key: _biometricWrappedKeyKey);
+      final ivB64 = await _storage.read(key: _biometricIvKey);
+
+      if (biometricKwkB64 == null || wrappedKeyB64 == null || ivB64 == null) {
+        throw StateError('Biometric key data incomplete');
+      }
+
+      final masterKey = _unwrapKey(
+        base64Decode(wrappedKeyB64),
+        base64Decode(biometricKwkB64),
+        base64Decode(ivB64),
+      );
+      _cachedMasterKey = masterKey;
+      return masterKey;
+    }
+
+    // Legacy: read raw key, create biometric wrapping, migrate
+    final rawKeyB64 = await _storage.read(key: _masterKeyKey);
+    if (rawKeyB64 != null) {
+      final masterKey = base64Decode(rawKeyB64);
+      await _setupBiometricKwkForKey(masterKey);
+      await _storage.delete(key: _masterKeyKey);
+      await _storage.write(key: _keyVersionKey, value: '1');
+      _cachedMasterKey = masterKey;
+      debugPrint('[Encryption] Migrated master key to wrapped form (biometric)');
+      return masterKey;
+    }
+
+    throw StateError('No master key found for biometric unlock');
+  }
+
+  /// Re-wrap the master key with a new credential (called on password/PIN change).
+  Future<void> reWrapKey(String newCredential, {bool isDecoy = false}) async {
+    final masterKey = isDecoy ? _cachedDecoyKey : _cachedMasterKey;
+    if (masterKey == null) throw StateError('Master key not unlocked');
+
+    await _wrapAndStoreKey(masterKey, newCredential, isDecoy: isDecoy);
+  }
+
+  /// Set up biometric KWK for the current master key (called when enabling biometric).
+  Future<void> setupBiometricKwk() async {
+    if (_cachedMasterKey == null) {
+      final version = await _storage.read(key: _keyVersionKey);
+      if (version == null) {
+        _cachedMasterKey = _generateRandomBytes(_keySize);
+        await _storage.write(key: _masterKeyKey, value: base64Encode(_cachedMasterKey!));
+      } else {
+        throw StateError('Master key not unlocked. Call unlockMasterKey first.');
+      }
+    }
+
+    await _setupBiometricKwkForKey(_cachedMasterKey!);
+
+    final version = await _storage.read(key: _keyVersionKey);
+    if (version == null) {
+      await _storage.write(key: _keyVersionKey, value: '1');
+      await _storage.delete(key: _masterKeyKey);
+    }
+  }
+
+  /// Remove biometric KWK (called when disabling biometric).
+  Future<void> removeBiometricKwk() async {
+    await _storage.delete(key: _biometricKwkKey);
+    await _storage.delete(key: _biometricWrappedKeyKey);
+    await _storage.delete(key: _biometricIvKey);
+  }
+
+  /// Check if biometric KWK is set up.
+  Future<bool> hasBiometricKwk() async {
+    final kwk = await _storage.read(key: _biometricKwkKey);
+    return kwk != null;
+  }
+
+  Future<void> _wrapAndStoreKey(
+    Uint8List masterKey,
+    String credential, {
+    required bool isDecoy,
+  }) async {
+    final salt = _generateRandomBytes(32);
+    final iv = generateIV();
+    final kwk = await computeArgon2idHash(credential, salt);
+    final wrappedKey = _wrapKey(masterKey, kwk, iv);
+
+    final wrappedKeyKey = isDecoy ? _decoyWrappedKeyKey : _wrappedKeyKey;
+    final saltKey = isDecoy ? _decoyKwkSaltKey : _kwkSaltKey;
+    final ivKey = isDecoy ? _decoyKwkIvKey : _kwkIvKey;
+
+    await _storage.write(key: wrappedKeyKey, value: base64Encode(wrappedKey));
+    await _storage.write(key: saltKey, value: base64Encode(salt));
+    await _storage.write(key: ivKey, value: base64Encode(iv));
+  }
+
+  Future<void> _setupBiometricKwkForKey(Uint8List masterKey) async {
+    final biometricKwk = _generateRandomBytes(_keySize);
+    final iv = generateIV();
+    final wrappedKey = _wrapKey(masterKey, biometricKwk, iv);
+
+    await _storage.write(key: _biometricKwkKey, value: base64Encode(biometricKwk));
+    await _storage.write(key: _biometricWrappedKeyKey, value: base64Encode(wrappedKey));
+    await _storage.write(key: _biometricIvKey, value: base64Encode(iv));
+  }
+
+  Uint8List _wrapKey(Uint8List masterKey, Uint8List kwk, Uint8List iv) {
+    final cipher = _getGcmCipher(kwk, iv, true);
+    return cipher.process(masterKey);
+  }
+
+  Uint8List _unwrapKey(Uint8List wrappedKey, Uint8List kwk, Uint8List iv) {
+    final cipher = _getGcmCipher(kwk, iv, false);
+    return cipher.process(wrappedKey);
+  }
+
   /// Ensure master key exists, create if not
   Future<Uint8List> _ensureMasterKey() async {
     if (_cachedMasterKey != null) return _cachedMasterKey!;
 
+    final version = await _storage.read(key: _keyVersionKey);
+    if (version == '1') {
+      throw StateError('Master key is wrapped. Call unlockMasterKey first.');
+    }
+
     try {
       final storedKey = await _storage.read(key: _masterKeyKey);
       if (storedKey != null) {
@@ -68,10 +290,15 @@ class EncryptionService {
       debugPrint('Error reading master key: $e');
     }
 
-    // Generate new master key
     _cachedMasterKey = _generateRandomBytes(_keySize);
-    await _storage.write(
-        key: _masterKeyKey, value: base64Encode(_cachedMasterKey!));
+    if (_pendingCredential != null) {
+      await _wrapAndStoreKey(_cachedMasterKey!, _pendingCredential!, isDecoy: false);
+      await _storage.write(key: _keyVersionKey, value: '1');
+      _pendingCredential = null;
+    } else {
+      await _storage.write(
+          key: _masterKeyKey, value: base64Encode(_cachedMasterKey!));
+    }
     return _cachedMasterKey!;
   }
 
@@ -83,6 +310,11 @@ class EncryptionService {
   Future<Uint8List> _ensureDecoyKey() async {
     if (_cachedDecoyKey != null) return _cachedDecoyKey!;
 
+    final version = await _storage.read(key: _decoyKeyVersionKey);
+    if (version == '1') {
+      throw StateError('Decoy key is wrapped. Call unlockMasterKey(isDecoy: true) first.');
+    }
+
     try {
       final storedKey = await _storage.read(key: _decoyKeyKey);
       if (storedKey != null) {
@@ -93,10 +325,15 @@ class EncryptionService {
       debugPrint('Error reading decoy key: $e');
     }
 
-    // Generate new decoy key
     _cachedDecoyKey = _generateRandomBytes(_keySize);
-    await _storage.write(
-        key: _decoyKeyKey, value: base64Encode(_cachedDecoyKey!));
+    if (_pendingDecoyCredential != null) {
+      await _wrapAndStoreKey(_cachedDecoyKey!, _pendingDecoyCredential!, isDecoy: true);
+      await _storage.write(key: _decoyKeyVersionKey, value: '1');
+      _pendingDecoyCredential = null;
+    } else {
+      await _storage.write(
+          key: _decoyKeyKey, value: base64Encode(_cachedDecoyKey!));
+    }
     return _cachedDecoyKey!;
   }
 
@@ -210,11 +447,10 @@ class EncryptionService {
 
       // Validate input data length for CBC mode
       if (encryptedData.length % 16 != 0) {
-        debugPrint(
-            'Decryption error: Invalid data length ${encryptedData.length} (not multiple of 16)');
-        // Try CTR mode as fallback - maybe file was incorrectly detected
-        debugPrint('[Encryption] Attempting CTR fallback...');
-        return await _tryCtrFallback(encryptedData, ivBase64, isDecoy);
+        return DecryptionResult(
+          success: false,
+          error: 'Invalid data length ${encryptedData.length} (not multiple of 16). File may be corrupted.',
+        );
       }
 
       final cipher = _getCipher(key, iv, false);
@@ -228,36 +464,7 @@ class EncryptionService {
       debugPrint('Decryption error: $e');
       return DecryptionResult(
         success: false,
-        error: 'Decryption failed: $e',
-      );
-    }
-  }
-
-  /// CTR fallback when CBC fails
-  Future<DecryptionResult> _tryCtrFallback(
-    Uint8List encryptedData,
-    String ivBase64,
-    bool isDecoy,
-  ) async {
-    try {
-      final key = isDecoy ? await _ensureDecoyKey() : await _ensureMasterKey();
-      final iv = base64Decode(ivBase64);
-
-      final ctr = CTRStreamCipher(AESEngine())
-        ..init(false, ParametersWithIV<KeyParameter>(KeyParameter(key), iv));
-
-      final decrypted = ctr.process(encryptedData);
-
-      debugPrint('[Encryption] CTR fallback succeeded!');
-      return DecryptionResult(
-        success: true,
-        data: decrypted,
-      );
-    } catch (e) {
-      debugPrint('[Encryption] CTR fallback failed: $e');
-      return DecryptionResult(
-        success: false,
-        error: 'Decryption failed: $e',
+        error: 'Decryption failed.',
       );
     }
   }
@@ -333,7 +540,7 @@ class EncryptionService {
       debugPrint('File streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'File streaming encryption failed: $e',
+        error: 'File streaming encryption failed.',
       );
     }
   }
@@ -391,7 +598,7 @@ class EncryptionService {
       debugPrint('Bytes streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'Bytes streaming encryption failed: $e',
+        error: 'Bytes streaming encryption failed.',
       );
     }
   }
@@ -443,7 +650,7 @@ class EncryptionService {
       debugPrint('Bytes GCM streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'Bytes GCM streaming encryption failed: $e',
+        error: 'Bytes GCM streaming encryption failed.',
       );
     }
   }
@@ -576,7 +783,7 @@ class EncryptionService {
       debugPrint('File decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'File decryption failed: $e',
+        error: 'File decryption failed.',
       );
     }
   }
@@ -742,7 +949,7 @@ class EncryptionService {
       debugPrint('File streaming decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'File streaming decryption failed: $e',
+        error: 'File streaming decryption failed.',
       );
     }
   }
@@ -867,7 +1074,7 @@ class EncryptionService {
       debugPrint('Streamed file decryption to memory error: $e');
       return DecryptionResult(
         success: false,
-        error: 'File decryption failed: $e',
+        error: 'File decryption failed.',
       );
     }
   }
@@ -912,7 +1119,7 @@ class EncryptionService {
       debugPrint('GCM Decryption error: $e');
       return DecryptionResult(
         success: false,
-        error: 'GCM Decryption failed: $e',
+        error: 'GCM Decryption failed.',
       );
     }
   }
@@ -997,7 +1204,7 @@ class EncryptionService {
       debugPrint('GCM File decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'GCM File decryption failed: $e',
+        error: 'GCM File decryption failed.',
       );
     }
   }
@@ -1076,7 +1283,7 @@ class EncryptionService {
       debugPrint('GCM v2 streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'GCM streaming encryption failed: $e',
+        error: 'GCM streaming encryption failed.',
       );
     }
   }
@@ -1151,7 +1358,7 @@ class EncryptionService {
       debugPrint('GCM streamed decryption error: $e');
       return DecryptionResult(
         success: false,
-        error: 'GCM decryption failed: $e',
+        error: 'GCM decryption failed.',
       );
     }
   }
@@ -1204,7 +1411,7 @@ class EncryptionService {
       debugPrint('Isolate pool encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'Isolate encryption failed: $e',
+        error: 'Isolate encryption failed.',
       );
     }
   }
@@ -1256,7 +1463,7 @@ class EncryptionService {
       debugPrint('Isolate pool decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'Isolate decryption failed: $e',
+        error: 'Isolate decryption failed.',
       );
     }
   }
@@ -1341,6 +1548,16 @@ class EncryptionService {
     }
   }
 
+  /// App-private temp dir for plaintext intermediates (never system temp).
+  /// ponytail: keeps decrypted rotation/re-encryption scratch off the shared
+  /// system temp; callers still secureDelete the plaintext file on cleanup.
+  Future<Directory> _createAppPrivateTemp(String prefix) async {
+    final docs = await getApplicationDocumentsDirectory();
+    final root = Directory('${docs.path}/.locker_temp');
+    await root.create(recursive: true);
+    return root.createTemp(prefix);
+  }
+
   Future<String> reEncryptFile(
     String filePath,
     String oldIvBase64, {
@@ -1353,7 +1570,7 @@ class EncryptionService {
     final isLegacyCbc = (format == 0 || format == 3);
 
     final key = await _resolveKey(isDecoy: isDecoy, derivedKey: oldDerivedKey);
-    final tempDir = await Directory.systemTemp.createTemp('lkr_reencrypt_');
+    final tempDir = await _createAppPrivateTemp('lkr_reencrypt_');
     final tempDecPath = '${tempDir.path}/decrypted';
 
     try {
@@ -1395,6 +1612,7 @@ class EncryptionService {
 
       return encResult.ivBase64!;
     } finally {
+      try { await secureDelete(tempDecPath); } catch (_) {}
       try { await tempDir.delete(recursive: true); } catch (_) {}
     }
   }
@@ -1443,7 +1661,7 @@ class EncryptionService {
       final doneSet = (journal['done'] as List).cast<String>().toSet();
       final ivs = (journal['ivs'] as Map<String, dynamic>).cast<String, String>();
 
-      final tempDir = await Directory.systemTemp.createTemp('lkr_rot_recovery_');
+      final tempDir = await _createAppPrivateTemp('lkr_rot_recovery_');
       try {
         for (final path in files) {
           if (doneSet.contains(path)) continue;
@@ -1487,7 +1705,7 @@ class EncryptionService {
           );
           await encJob.future;
 
-          try { await File(tempDecPath).delete(); } catch (_) {}
+          try { await secureDelete(tempDecPath); } catch (_) {}
         }
       } finally {
         try { await tempDir.delete(recursive: true); } catch (_) {}
@@ -1537,7 +1755,7 @@ class EncryptionService {
       };
       await _storage.write(key: _rotationJournalKey, value: jsonEncode(journal));
 
-      final tempDir = await Directory.systemTemp.createTemp('lkr_rotate_');
+      final tempDir = await _createAppPrivateTemp('lkr_rotate_');
       try {
         for (int i = 0; i < encryptedFilePaths.length; i++) {
           onProgress?.call(i + 1, encryptedFilePaths.length);
@@ -1576,7 +1794,7 @@ class EncryptionService {
             } catch (e) {
               return KeyRotationResult(
                 success: false,
-                error: 'Failed to decrypt file at index $i: $e',
+                error: 'Failed to decrypt file at index $i.',
                 processedCount: i,
               );
             }
@@ -1592,7 +1810,7 @@ class EncryptionService {
           final encResult = await encJob.future;
           newIvs.add(encResult.ivBase64!);
 
-          try { await File(tempDecPath).delete(); } catch (_) {}
+          try { await secureDelete(tempDecPath); } catch (_) {}
 
           journal['done'] = encryptedFilePaths.sublist(0, i + 1);
           await _storage.write(key: _rotationJournalKey, value: jsonEncode(journal));
@@ -1613,7 +1831,7 @@ class EncryptionService {
       debugPrint('Key rotation error: $e');
       return KeyRotationResult(
         success: false,
-        error: 'Key rotation failed: $e',
+        error: 'Key rotation failed.',
       );
     }
   }
@@ -1621,6 +1839,11 @@ class EncryptionService {
   /// Check if encryption is enabled
   Future<bool> hasEncryptionKey() async {
     try {
+      final version = await _storage.read(key: _keyVersionKey);
+      if (version == '1') {
+        final wrappedKey = await _storage.read(key: _wrappedKeyKey);
+        return wrappedKey != null;
+      }
       final key = await _storage.read(key: _masterKeyKey);
       return key != null;
     } catch (e) {
@@ -1631,10 +1854,26 @@ class EncryptionService {
   Future<void> resetKeys() async {
     _cachedMasterKey = null;
     _cachedDecoyKey = null;
+    _pendingCredential = null;
+    _pendingDecoyCredential = null;
+
     await _storage.delete(key: _masterKeyKey);
     await _storage.delete(key: _decoyKeyKey);
     await _storage.delete(key: _oldMasterKeyKey);
     await _storage.delete(key: _rotationJournalKey);
+
+    await _storage.delete(key: _keyVersionKey);
+    await _storage.delete(key: _wrappedKeyKey);
+    await _storage.delete(key: _kwkSaltKey);
+    await _storage.delete(key: _kwkIvKey);
+    await _storage.delete(key: _biometricKwkKey);
+    await _storage.delete(key: _biometricWrappedKeyKey);
+    await _storage.delete(key: _biometricIvKey);
+
+    await _storage.delete(key: _decoyKeyVersionKey);
+    await _storage.delete(key: _decoyWrappedKeyKey);
+    await _storage.delete(key: _decoyKwkSaltKey);
+    await _storage.delete(key: _decoyKwkIvKey);
   }
 }
 
diff --git a/lib/services/file_import_service.dart b/lib/services/file_import_service.dart
index 4305e1c..5435c47 100644
--- a/lib/services/file_import_service.dart
+++ b/lib/services/file_import_service.dart
@@ -4,6 +4,7 @@ import 'package:file_picker/file_picker.dart';
 import 'package:image_picker/image_picker.dart';
 import 'package:mime/mime.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:photo_manager/photo_manager.dart';
 import '../models/encryption_algorithm.dart';
 import '../models/vaulted_file.dart';
@@ -1612,13 +1613,7 @@ class FileImportService {
   /// Try to get the original path from a cached/picked file path
   Future<String?> _getOriginalPath(String cachedPath, String fileName) async {
     // Common locations to check
-    final possibleDirs = [
-      '/storage/emulated/0/Download',
-      '/storage/emulated/0/Documents',
-      '/storage/emulated/0/DCIM',
-      '/sdcard/Download',
-      '/sdcard/Documents',
-    ];
+    final possibleDirs = PathUtils.androidSourceRoots;
 
     for (final dir in possibleDirs) {
       final possiblePath = '$dir/$fileName';
diff --git a/lib/services/file_open_service.dart b/lib/services/file_open_service.dart
index fe843c2..e529072 100644
--- a/lib/services/file_open_service.dart
+++ b/lib/services/file_open_service.dart
@@ -26,6 +26,7 @@ class FileOpenService {
   /// used to build the swipeable gallery context for images and videos.
   /// [onUnsupported] is called when the file has no built-in viewer.
   /// [onOpenNote] is called when the vault entry represents a note.
+  /// [onOpenPassword] is called when the vault entry represents a password.
   static Future<void> open(
     BuildContext context,
     WidgetRef ref,
@@ -33,6 +34,7 @@ class FileOpenService {
     required List<VaultedFile> currentFiles,
     VoidCallback? onUnsupported,
     ValueChanged<String>? onOpenNote,
+    ValueChanged<String>? onOpenPassword,
   }) async {
     if (_isOpening) return;
     if (!context.mounted) return;
@@ -97,6 +99,17 @@ class FileOpenService {
         return;
       }
 
+      final passwordId = file.metadata?['passwordId'] as String?;
+      if (passwordId != null) {
+        hideOverlay();
+        if (onOpenPassword != null) {
+          onOpenPassword(passwordId);
+        } else {
+          onUnsupported?.call();
+        }
+        return;
+      }
+
       final vaultService = ref.read(vaultServiceProvider);
       final needsDecryption = file.isEncrypted && file.encryptionIv != null;
 
diff --git a/lib/services/improved_compression_service.dart b/lib/services/improved_compression_service.dart
deleted file mode 100644
index 65248f1..0000000
--- a/lib/services/improved_compression_service.dart
+++ /dev/null
@@ -1,374 +0,0 @@
-import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
-import 'dart:isolate';
-import 'package:flutter/foundation.dart';
-import 'package:path_provider/path_provider.dart';
-
-/// Improved compression service with isolate support, progress tracking, and cancellation
-class ImprovedCompressionService {
-  ImprovedCompressionService._();
-  static final ImprovedCompressionService instance = ImprovedCompressionService._();
-
-  final Map<String, CompressionTask> _activeTasks = {};
-
-  /// Compress video with progress tracking and cancellation support
-  Future<CompressionResult?> compressVideo({
-    required String sourcePath,
-    required String taskId,
-    VideoCompressionQuality quality = VideoCompressionQuality.medium,
-    Function(double progress)? onProgress,
-  }) async {
-    try {
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        debugPrint('[ImprovedCompression] Source file does not exist: $sourcePath');
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-      
-      // Skip compression for very small files (< 5MB)
-      if (originalSize < 5 * 1024 * 1024) {
-        debugPrint('[ImprovedCompression] File too small to compress, skipping');
-        return CompressionResult(
-          compressedPath: sourcePath,
-          originalSize: originalSize,
-          compressedSize: originalSize,
-          compressionRatio: 0,
-          skipped: true,
-        );
-      }
-
-      final tempDir = await getTemporaryDirectory();
-      final outputPath = '${tempDir.path}/compressed_${DateTime.now().millisecondsSinceEpoch}.mp4';
-
-      // Create receive port for isolate communication
-      final receivePort = ReceivePort();
-      final completer = Completer<CompressionResult?>();
-
-      // Create task for tracking
-      final task = CompressionTask(
-        taskId: taskId,
-        sourcePath: sourcePath,
-        outputPath: outputPath,
-        receivePort: receivePort,
-        completer: completer,
-      );
-      _activeTasks[taskId] = task;
-
-      // Spawn isolate
-      final isolate = await Isolate.spawn(
-        _videoCompressionIsolate,
-        _VideoCompressionParams(
-          sourcePath: sourcePath,
-          outputPath: outputPath,
-          quality: quality,
-          sendPort: receivePort.sendPort,
-        ),
-      );
-
-      task.isolate = isolate;
-
-      // Listen to isolate messages
-      receivePort.listen((message) {
-        if (message is Map<String, dynamic>) {
-          if (message['type'] == 'progress') {
-            final progress = message['progress'] as double;
-            onProgress?.call(progress);
-          } else if (message['type'] == 'complete') {
-            final result = CompressionResult(
-              compressedPath: message['outputPath'] as String,
-              originalSize: message['originalSize'] as int,
-              compressedSize: message['compressedSize'] as int,
-              compressionRatio: message['compressionRatio'] as double,
-            );
-            completer.complete(result);
-            _cleanupTask(taskId);
-          } else if (message['type'] == 'error') {
-            completer.completeError(message['error'] as String);
-            _cleanupTask(taskId);
-          } else if (message['type'] == 'cancelled') {
-            completer.complete(null);
-            _cleanupTask(taskId);
-          }
-        }
-      });
-
-      return await completer.future;
-    } catch (e) {
-      debugPrint('[ImprovedCompression] Error compressing video: $e');
-      _cleanupTask(taskId);
-      return null;
-    }
-  }
-
-  /// Cancel compression and rollback changes
-  Future<bool> cancelCompression(String taskId) async {
-    final task = _activeTasks[taskId];
-    if (task == null) {
-      debugPrint('[ImprovedCompression] Task not found: $taskId');
-      return false;
-    }
-
-    try {
-      debugPrint('[ImprovedCompression] Cancelling task: $taskId');
-      
-      // Kill the isolate
-      task.isolate?.kill(priority: Isolate.immediate);
-      
-      // Delete partial output file
-      final outputFile = File(task.outputPath);
-      if (await outputFile.exists()) {
-        await outputFile.delete();
-        debugPrint('[ImprovedCompression] Deleted partial output: ${task.outputPath}');
-      }
-
-      // Complete with null to indicate cancellation
-      if (!task.completer.isCompleted) {
-        task.completer.complete(null);
-      }
-
-      _cleanupTask(taskId);
-      return true;
-    } catch (e) {
-      debugPrint('[ImprovedCompression] Error cancelling task: $e');
-      return false;
-    }
-  }
-
-  /// Cleanup task resources
-  void _cleanupTask(String taskId) {
-    final task = _activeTasks.remove(taskId);
-    if (task != null) {
-      task.receivePort.close();
-      task.isolate?.kill(priority: Isolate.immediate);
-    }
-  }
-
-  /// Check if FFmpeg is available
-  Future<bool> isFFmpegAvailable() async {
-    try {
-      final result = await Process.run('ffmpeg', ['-version']);
-      return result.exitCode == 0;
-    } catch (e) {
-      return false;
-    }
-  }
-
-  /// Get all active compression tasks
-  List<String> getActiveTasks() {
-    return _activeTasks.keys.toList();
-  }
-}
-
-/// Isolate function for video compression
-void _videoCompressionIsolate(_VideoCompressionParams params) async {
-  Process? process;
-  
-  try {
-    final sourceFile = File(params.sourcePath);
-    final originalSize = await sourceFile.length();
-
-    // Get video duration for progress calculation
-    final durationResult = await Process.run('ffprobe', [
-      '-v',
-      'error',
-      '-show_entries',
-      'format=duration',
-      '-of',
-      'default=noprint_wrappers=1:nokey=1',
-      params.sourcePath,
-    ]);
-
-    double? totalDuration;
-    if (durationResult.exitCode == 0) {
-      totalDuration = double.tryParse(durationResult.stdout.toString().trim());
-    }
-
-    // Build FFmpeg command based on quality
-    final args = _buildFFmpegArgs(params.sourcePath, params.outputPath, params.quality);
-
-    // Start FFmpeg process
-    process = await Process.start('ffmpeg', args);
-
-    // Monitor stderr for progress
-    final stderrSubscription = process.stderr
-        .transform(utf8.decoder)
-        .transform(const LineSplitter())
-        .listen((line) {
-      // Parse FFmpeg progress: "frame= 123 fps=30 time=00:00:04.10"
-      if (totalDuration != null && line.contains('time=')) {
-        final timeMatch = RegExp(r'time=(\d+):(\d+):(\d+\.\d+)').firstMatch(line);
-        if (timeMatch != null) {
-          final hours = int.parse(timeMatch.group(1)!);
-          final minutes = int.parse(timeMatch.group(2)!);
-          final seconds = double.parse(timeMatch.group(3)!);
-          final currentTime = hours * 3600 + minutes * 60 + seconds;
-          final progress = (currentTime / totalDuration).clamp(0.0, 1.0);
-          
-          params.sendPort.send({
-            'type': 'progress',
-            'progress': progress,
-          });
-        }
-      }
-    });
-
-    final exitCode = await process.exitCode;
-    await stderrSubscription.cancel();
-
-    if (exitCode == 0) {
-      final outputFile = File(params.outputPath);
-      if (await outputFile.exists()) {
-        final compressedSize = await outputFile.length();
-        final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-        params.sendPort.send({
-          'type': 'complete',
-          'outputPath': params.outputPath,
-          'originalSize': originalSize,
-          'compressedSize': compressedSize,
-          'compressionRatio': compressionRatio,
-        });
-      } else {
-        params.sendPort.send({
-          'type': 'error',
-          'error': 'Output file not created',
-        });
-      }
-    } else {
-      params.sendPort.send({
-        'type': 'error',
-        'error': 'FFmpeg exited with code $exitCode',
-      });
-    }
-  } catch (e) {
-    // Check if it was a cancellation
-    if (e.toString().contains('killed') || e.toString().contains('cancelled')) {
-      params.sendPort.send({'type': 'cancelled'});
-    } else {
-      params.sendPort.send({
-        'type': 'error',
-        'error': e.toString(),
-      });
-    }
-  } finally {
-    process?.kill();
-  }
-}
-
-/// Build FFmpeg arguments based on quality
-List<String> _buildFFmpegArgs(String input, String output, VideoCompressionQuality quality) {
-  final baseArgs = ['-i', input];
-  
-  switch (quality) {
-    case VideoCompressionQuality.high:
-      return [
-        ...baseArgs,
-        '-vcodec', 'libx264',
-        '-preset', 'medium',
-        '-crf', '18',
-        '-acodec', 'aac',
-        '-b:a', '192k',
-        '-movflags', '+faststart',
-        '-y',
-        output,
-      ];
-    case VideoCompressionQuality.medium:
-      return [
-        ...baseArgs,
-        '-vcodec', 'libx264',
-        '-preset', 'fast',
-        '-crf', '23',
-        '-acodec', 'aac',
-        '-b:a', '128k',
-        '-movflags', '+faststart',
-        '-y',
-        output,
-      ];
-    case VideoCompressionQuality.low:
-      return [
-        ...baseArgs,
-        '-vcodec', 'libx264',
-        '-preset', 'veryfast',
-        '-crf', '28',
-        '-acodec', 'aac',
-        '-b:a', '96k',
-        '-movflags', '+faststart',
-        '-y',
-        output,
-      ];
-  }
-}
-
-/// Compression task tracking
-class CompressionTask {
-  final String taskId;
-  final String sourcePath;
-  final String outputPath;
-  final ReceivePort receivePort;
-  final Completer<CompressionResult?> completer;
-  Isolate? isolate;
-
-  CompressionTask({
-    required this.taskId,
-    required this.sourcePath,
-    required this.outputPath,
-    required this.receivePort,
-    required this.completer,
-    this.isolate,
-  });
-}
-
-/// Parameters for video compression isolate
-class _VideoCompressionParams {
-  final String sourcePath;
-  final String outputPath;
-  final VideoCompressionQuality quality;
-  final SendPort sendPort;
-
-  const _VideoCompressionParams({
-    required this.sourcePath,
-    required this.outputPath,
-    required this.quality,
-    required this.sendPort,
-  });
-}
-
-/// Video compression quality levels
-enum VideoCompressionQuality {
-  high,   // CRF 18, slower but better quality
-  medium, // CRF 23, balanced
-  low,    // CRF 28, faster but lower quality
-}
-
-/// Result of compression operation
-class CompressionResult {
-  final String compressedPath;
-  final int originalSize;
-  final int compressedSize;
-  final double compressionRatio;
-  final bool skipped;
-
-  CompressionResult({
-    required this.compressedPath,
-    required this.originalSize,
-    required this.compressedSize,
-    required this.compressionRatio,
-    this.skipped = false,
-  });
-
-  String get formattedOriginalSize => _formatBytes(originalSize);
-  String get formattedCompressedSize => _formatBytes(compressedSize);
-  String get formattedRatio => '${compressionRatio.toStringAsFixed(1)}%';
-
-  static String _formatBytes(int bytes) {
-    if (bytes < 1024) return '$bytes B';
-    if (bytes < 1024 * 1024) return '${(bytes / 1024).toStringAsFixed(1)} KB';
-    if (bytes < 1024 * 1024 * 1024) {
-      return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
-    }
-    return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
-  }
-}
diff --git a/lib/services/media_compression_service.dart b/lib/services/media_compression_service.dart
deleted file mode 100644
index c9872e5..0000000
--- a/lib/services/media_compression_service.dart
+++ /dev/null
@@ -1,274 +0,0 @@
-import 'dart:io';
-import 'package:flutter/foundation.dart';
-import 'package:flutter_image_compress/flutter_image_compress.dart';
-import 'package:image/image.dart' as img;
-import 'package:path_provider/path_provider.dart';
-import 'package:video_compress/video_compress.dart';
-
-/// Service for compressing photos and videos
-class MediaCompressionService {
-  MediaCompressionService._();
-  static final MediaCompressionService instance = MediaCompressionService._();
-
-  /// Compression quality levels
-  static const int qualityHigh = 85;
-  static const int qualityMedium = 70;
-  static const int qualityLow = 50;
-
-  /// Video compression quality levels
-  static const VideoQuality videoQualityHigh = VideoQuality.HighestQuality;
-  static const VideoQuality videoQualityMedium = VideoQuality.DefaultQuality;
-  static const VideoQuality videoQualityLow = VideoQuality.LowQuality;
-
-  /// Compress an image file
-  /// Returns the path to the compressed file, or null if compression failed
-  Future<CompressionResult?> compressImage({
-    required String sourcePath,
-    int quality = qualityMedium,
-    int? maxWidth,
-    int? maxHeight,
-    bool keepExif = true,
-  }) async {
-    try {
-      debugPrint('[Compression] Compressing image: $sourcePath');
-      
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        debugPrint('[Compression] Source file does not exist');
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-      
-      // Create temp directory for compressed file
-      final tempDir = await getTemporaryDirectory();
-      final fileName = sourcePath.split('/').last;
-      final targetPath = '${tempDir.path}/compressed_$fileName';
-
-      // Compress using flutter_image_compress
-      final result = await FlutterImageCompress.compressAndGetFile(
-        sourcePath,
-        targetPath,
-        quality: quality,
-        minWidth: maxWidth ?? 1920,
-        minHeight: maxHeight ?? 1920,
-        keepExif: keepExif,
-      );
-
-      if (result == null) {
-        debugPrint('[Compression] Image compression failed');
-        return null;
-      }
-
-      final compressedSize = await result.length();
-      final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-      debugPrint('[Compression] Image compressed: ${_formatBytes(originalSize)} → ${_formatBytes(compressedSize)} (${compressionRatio.toStringAsFixed(1)}% reduction)');
-
-      return CompressionResult(
-        compressedPath: result.path,
-        originalSize: originalSize,
-        compressedSize: compressedSize,
-        compressionRatio: compressionRatio,
-      );
-    } catch (e) {
-      debugPrint('[Compression] Error compressing image: $e');
-      return null;
-    }
-  }
-
-  /// Compress an image with custom dimensions
-  Future<CompressionResult?> compressImageWithDimensions({
-    required String sourcePath,
-    required int targetWidth,
-    required int targetHeight,
-    int quality = qualityMedium,
-  }) async {
-    try {
-      debugPrint('[Compression] Compressing image with dimensions: ${targetWidth}x$targetHeight');
-      
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-      
-      // Read and decode image
-      final bytes = await sourceFile.readAsBytes();
-      final image = img.decodeImage(bytes);
-      
-      if (image == null) {
-        debugPrint('[Compression] Failed to decode image');
-        return null;
-      }
-
-      // Resize image maintaining aspect ratio
-      final resized = img.copyResize(
-        image,
-        width: targetWidth,
-        height: targetHeight,
-        interpolation: img.Interpolation.linear,
-      );
-
-      // Encode with quality
-      final List<int> compressed;
-      final ext = sourcePath.split('.').last.toLowerCase();
-      
-      if (ext == 'png') {
-        compressed = img.encodePng(resized, level: 6);
-      } else {
-        compressed = img.encodeJpg(resized, quality: quality);
-      }
-
-      // Save to temp file
-      final tempDir = await getTemporaryDirectory();
-      final fileName = sourcePath.split('/').last;
-      final targetPath = '${tempDir.path}/resized_$fileName';
-      final targetFile = File(targetPath);
-      await targetFile.writeAsBytes(compressed);
-
-      final compressedSize = compressed.length;
-      final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-      debugPrint('[Compression] Image resized and compressed: ${_formatBytes(originalSize)} → ${_formatBytes(compressedSize)}');
-
-      return CompressionResult(
-        compressedPath: targetPath,
-        originalSize: originalSize,
-        compressedSize: compressedSize,
-        compressionRatio: compressionRatio,
-      );
-    } catch (e) {
-      debugPrint('[Compression] Error compressing image with dimensions: $e');
-      return null;
-    }
-  }
-
-  /// Compress a video file
-  /// Returns the path to the compressed file, or null if compression failed
-  Future<CompressionResult?> compressVideo({
-    required String sourcePath,
-    VideoQuality quality = videoQualityMedium,
-    bool deleteOrigin = false,
-    Function(double progress)? onProgress,
-  }) async {
-    try {
-      debugPrint('[Compression] Compressing video: $sourcePath');
-      
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        debugPrint('[Compression] Source file does not exist');
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-
-      // Subscribe to compression progress
-      VideoCompress.compressProgress$.subscribe((progress) {
-        onProgress?.call(progress);
-      });
-
-      // Compress video
-      final info = await VideoCompress.compressVideo(
-        sourcePath,
-        quality: quality,
-        deleteOrigin: deleteOrigin,
-        includeAudio: true,
-      );
-
-      if (info == null || info.file == null) {
-        debugPrint('[Compression] Video compression failed');
-        return null;
-      }
-
-      final compressedSize = await info.file!.length();
-      final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-      debugPrint('[Compression] Video compressed: ${_formatBytes(originalSize)} → ${_formatBytes(compressedSize)} (${compressionRatio.toStringAsFixed(1)}% reduction)');
-
-      return CompressionResult(
-        compressedPath: info.file!.path,
-        originalSize: originalSize,
-        compressedSize: compressedSize,
-        compressionRatio: compressionRatio,
-        duration: info.duration,
-      );
-    } catch (e) {
-      debugPrint('[Compression] Error compressing video: $e');
-      return null;
-    }
-  }
-
-  /// Get video thumbnail
-  Future<File?> getVideoThumbnail({
-    required String videoPath,
-    int quality = 50,
-  }) async {
-    try {
-      final thumbnail = await VideoCompress.getFileThumbnail(
-        videoPath,
-        quality: quality,
-      );
-      return thumbnail;
-    } catch (e) {
-      debugPrint('[Compression] Error getting video thumbnail: $e');
-      return null;
-    }
-  }
-
-  /// Cancel ongoing video compression
-  Future<void> cancelVideoCompression() async {
-    try {
-      await VideoCompress.cancelCompression();
-    } catch (e) {
-      debugPrint('[Compression] Error canceling compression: $e');
-    }
-  }
-
-  /// Delete all cached compressed files
-  Future<void> clearCache() async {
-    try {
-      await VideoCompress.deleteAllCache();
-      debugPrint('[Compression] Cache cleared');
-    } catch (e) {
-      debugPrint('[Compression] Error clearing cache: $e');
-    }
-  }
-
-  /// Format bytes to human-readable string
-  String _formatBytes(int bytes) {
-    if (bytes < 1024) return '$bytes B';
-    if (bytes < 1024 * 1024) return '${(bytes / 1024).toStringAsFixed(1)} KB';
-    if (bytes < 1024 * 1024 * 1024) return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
-    return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
-  }
-}
-
-/// Result of a compression operation
-class CompressionResult {
-  final String compressedPath;
-  final int originalSize;
-  final int compressedSize;
-  final double compressionRatio;
-  final double? duration;
-
-  CompressionResult({
-    required this.compressedPath,
-    required this.originalSize,
-    required this.compressedSize,
-    required this.compressionRatio,
-    this.duration,
-  });
-
-  String get formattedOriginalSize => _formatBytes(originalSize);
-  String get formattedCompressedSize => _formatBytes(compressedSize);
-  String get formattedRatio => '${compressionRatio.toStringAsFixed(1)}%';
-
-  static String _formatBytes(int bytes) {
-    if (bytes < 1024) return '$bytes B';
-    if (bytes < 1024 * 1024) return '${(bytes / 1024).toStringAsFixed(1)} KB';
-    if (bytes < 1024 * 1024 * 1024) return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
-    return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
-  }
-}
diff --git a/lib/services/password_service.dart b/lib/services/password_service.dart
new file mode 100644
index 0000000..984d374
--- /dev/null
+++ b/lib/services/password_service.dart
@@ -0,0 +1,307 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:path_provider/path_provider.dart';
+import 'package:uuid/uuid.dart';
+
+import '../models/password_entry.dart';
+import '../models/encryption_algorithm.dart';
+import 'encryption_service.dart';
+import 'vault_service.dart';
+
+class PasswordService {
+  PasswordService._();
+  static final PasswordService instance = PasswordService._();
+
+  final FlutterSecureStorage _secureStorage = const FlutterSecureStorage();
+  final EncryptionService _encryptionService = EncryptionService.instance;
+
+  static const String _indexKey = 'locker_passwords_index';
+  static const String _dirName = 'passwords';
+  static const int _defaultKdfIterations = 100000;
+
+  List<PasswordEntry>? _cachedEntries;
+
+  Future<String> _getDir({bool isDecoy = false}) async {
+    final appDir = await getApplicationDocumentsDirectory();
+    final baseDir = isDecoy ? '.locker_decoy' : '.locker_vault';
+    return '${appDir.path}/$baseDir/$_dirName';
+  }
+
+  Future<void> _ensureDir({bool isDecoy = false}) async {
+    final dir = Directory(await _getDir(isDecoy: isDecoy));
+    if (!await dir.exists()) {
+      await dir.create(recursive: true);
+    }
+  }
+
+  Future<List<PasswordEntry>> loadPasswords({bool isDecoy = false}) async {
+    if (_cachedEntries != null) return _cachedEntries!;
+    final json = await _secureStorage.read(key: _indexKey);
+    if (json == null || json.isEmpty) {
+      _cachedEntries = [];
+      return _cachedEntries!;
+    }
+    try {
+      final List<dynamic> decoded = jsonDecode(json) as List<dynamic>;
+      _cachedEntries = decoded
+          .map((e) => PasswordEntry.fromJson(e as Map<String, dynamic>))
+          .toList();
+    } catch (_) {
+      _cachedEntries = [];
+    }
+    return _cachedEntries!;
+  }
+
+  Future<void> _save() async {
+    if (_cachedEntries == null) return;
+    final json =
+        jsonEncode(_cachedEntries!.map((e) => e.toJson()).toList());
+    await _secureStorage.write(key: _indexKey, value: json);
+  }
+
+  Future<Uint8List> _deriveKey(
+    PasswordEntry entry, {
+    bool isDecoy = false,
+  }) async {
+    final masterKey =
+        await _encryptionService.getMasterKey(isDecoy: isDecoy);
+    final salt = base64Decode(entry.keyDerivationSalt);
+    return _encryptionService.deriveFileKeyAsync(
+        masterKey, salt, entry.kdfIterations);
+  }
+
+  Future<PasswordEntry> createPassword({
+    required String title,
+    required PasswordContent content,
+    List<String> tags = const [],
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = _defaultKdfIterations,
+    bool isDecoy = false,
+    void Function(String status, {bool isEncrypting})? onProgress,
+  }) async {
+    onProgress?.call('Preparing...', isEncrypting: false);
+    await _ensureDir(isDecoy: isDecoy);
+    await loadPasswords(isDecoy: isDecoy);
+
+    final id = const Uuid().v4();
+    final now = DateTime.now();
+    final dir = await _getDir(isDecoy: isDecoy);
+
+    onProgress?.call('Encrypting...', isEncrypting: true);
+    final filePath = '$dir/$id.enc';
+    final masterKey =
+        await _encryptionService.getMasterKey(isDecoy: isDecoy);
+    final saltBytes = _encryptionService.generateFileSalt();
+    final derivedKey = await _encryptionService.deriveFileKeyAsync(
+      masterKey,
+      saltBytes,
+      kdfIterations,
+    );
+
+    final data =
+        Uint8List.fromList(utf8.encode(content.toJsonString()));
+    final result = encryptionAlgorithm == EncryptionAlgorithm.aes256Gcm
+        ? await _encryptionService.encryptBytesStreamedGcm(
+            data,
+            filePath,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          )
+        : await _encryptionService.encryptBytesStreamed(
+            data,
+            filePath,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          );
+
+    if (!result.success) {
+      throw Exception('Failed to encrypt password entry');
+    }
+
+    onProgress?.call('Registering in vault...', isEncrypting: false);
+    final entry = PasswordEntry(
+      id: id,
+      title: title,
+      encryptedContentPath: result.encryptedPath!,
+      iv: result.iv!,
+      keyDerivationSalt: base64Encode(saltBytes),
+      kdfIterations: kdfIterations,
+      tags: tags,
+      isEncrypted: true,
+      encryptionAlgorithm: encryptionAlgorithm,
+      createdAt: now,
+      updatedAt: now,
+    );
+
+    _cachedEntries!.insert(0, entry);
+    await _save();
+
+    await VaultService.instance.registerPasswordEntry(
+      passwordId: entry.id,
+      title: entry.title,
+      encryptedContentPath: entry.encryptedContentPath,
+      tags: entry.tags,
+      isEncrypted: true,
+      encryptionAlgorithm: encryptionAlgorithm,
+      kdfIterations: kdfIterations,
+      isDecoy: isDecoy,
+    );
+
+    return entry;
+  }
+
+  Future<PasswordContent> decryptContent(
+    PasswordEntry entry, {
+    bool isDecoy = false,
+  }) async {
+    final derivedKey = await _deriveKey(entry, isDecoy: isDecoy);
+
+    final result = entry.encryptionAlgorithm == EncryptionAlgorithm.aes256Gcm
+        ? await _encryptionService.decryptStreamedFileToMemoryGcm(
+            entry.encryptedContentPath,
+            entry.iv,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          )
+        : await _encryptionService.decryptStreamedFileToMemory(
+            entry.encryptedContentPath,
+            entry.iv,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          );
+
+    if (!result.success || result.data == null) {
+      throw Exception('Failed to decrypt password entry');
+    }
+
+    return PasswordContent.fromJsonString(utf8.decode(result.data!));
+  }
+
+  Future<PasswordEntry> updatePassword(
+    PasswordEntry entry, {
+    String? title,
+    PasswordContent? content,
+    List<String>? tags,
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = _defaultKdfIterations,
+    bool isDecoy = false,
+  }) async {
+    await loadPasswords(isDecoy: isDecoy);
+
+    var updated = entry.copyWith(
+      title: title,
+      tags: tags,
+      encryptionAlgorithm: encryptionAlgorithm,
+      updatedAt: DateTime.now(),
+    );
+
+    if (content != null) {
+      final masterKey =
+          await _encryptionService.getMasterKey(isDecoy: isDecoy);
+      final salt = _encryptionService.generateFileSalt();
+      final derivedKey = await _encryptionService.deriveFileKeyAsync(
+        masterKey,
+        salt,
+        kdfIterations,
+      );
+
+      final data =
+          Uint8List.fromList(utf8.encode(content.toJsonString()));
+      final result = updated.encryptionAlgorithm == EncryptionAlgorithm.aes256Gcm
+          ? await _encryptionService.encryptBytesStreamedGcm(
+              data,
+              entry.encryptedContentPath,
+              isDecoy: isDecoy,
+              derivedKey: derivedKey,
+            )
+          : await _encryptionService.encryptBytesStreamed(
+              data,
+              entry.encryptedContentPath,
+              isDecoy: isDecoy,
+              derivedKey: derivedKey,
+            );
+
+      if (!result.success) {
+        throw Exception('Failed to re-encrypt password entry');
+      }
+
+      updated = updated.copyWith(
+        encryptedContentPath: result.encryptedPath,
+        iv: result.iv,
+        keyDerivationSalt: base64Encode(salt),
+        kdfIterations: kdfIterations,
+      );
+    }
+
+    final index = _cachedEntries!.indexWhere((e) => e.id == entry.id);
+    if (index != -1) {
+      _cachedEntries![index] = updated;
+      await _save();
+
+      await VaultService.instance.registerPasswordEntry(
+        passwordId: updated.id,
+        title: updated.title,
+        encryptedContentPath: updated.encryptedContentPath,
+        tags: updated.tags,
+        isEncrypted: true,
+        encryptionAlgorithm: updated.encryptionAlgorithm,
+        kdfIterations: updated.kdfIterations,
+        isDecoy: isDecoy,
+      );
+    }
+
+    return updated;
+  }
+
+  Future<void> deletePassword(PasswordEntry entry,
+      {bool isDecoy = false}) async {
+    await loadPasswords(isDecoy: isDecoy);
+    await _encryptionService.secureDelete(entry.encryptedContentPath);
+    _cachedEntries!.removeWhere((e) => e.id == entry.id);
+    await _save();
+    await VaultService.instance.removePasswordEntry(entry.id, isDecoy: isDecoy);
+  }
+
+  Future<void> deletePasswords(List<PasswordEntry> entries,
+      {bool isDecoy = false}) async {
+    await loadPasswords(isDecoy: isDecoy);
+    for (final entry in entries) {
+      await _encryptionService.secureDelete(entry.encryptedContentPath);
+    }
+    final ids = entries.map((e) => e.id).toSet();
+    _cachedEntries!.removeWhere((e) => ids.contains(e.id));
+    await _save();
+    for (final entry in entries) {
+      await VaultService.instance.removePasswordEntry(entry.id, isDecoy: isDecoy);
+    }
+  }
+
+  Future<PasswordEntry> toggleFavorite(PasswordEntry entry,
+      {bool isDecoy = false}) async {
+    await loadPasswords(isDecoy: isDecoy);
+    final toggled = entry.toggleFavorite();
+    final index = _cachedEntries!.indexWhere((e) => e.id == entry.id);
+    if (index != -1) {
+      _cachedEntries![index] = toggled;
+      await _save();
+    }
+    return toggled;
+  }
+
+  List<PasswordEntry> searchPasswords(String query) {
+    if (_cachedEntries == null) return [];
+    final lower = query.toLowerCase();
+    return _cachedEntries!
+        .where((e) =>
+            e.title.toLowerCase().contains(lower) ||
+            e.tags.any((t) => t.contains(lower)))
+        .toList();
+  }
+
+  void clearCache() {
+    _cachedEntries = null;
+  }
+}
diff --git a/lib/services/permission_service.dart b/lib/services/permission_service.dart
index f018376..cfc0d93 100644
--- a/lib/services/permission_service.dart
+++ b/lib/services/permission_service.dart
@@ -1,4 +1,5 @@
 import 'dart:io';
+import 'package:device_info_plus/device_info_plus.dart';
 import 'package:flutter/foundation.dart';
 import 'package:permission_handler/permission_handler.dart';
 import 'auto_kill_service.dart';
@@ -315,13 +316,11 @@ class PermissionService {
     if (!Platform.isAndroid) return 0;
 
     try {
-      // Use ProcessInfo or default to a safe version
-      // In a real app, you'd use device_info_plus
-      // For now, we'll default to 33 (Android 13) which is common
-      return 33;
+      final deviceInfo = await DeviceInfoPlugin().androidInfo;
+      return deviceInfo.version.sdkInt;
     } catch (e) {
       debugPrint('Error getting Android SDK version: $e');
-      return 33; // Default to Android 13
+      return 0;
     }
   }
 }
diff --git a/lib/services/vault_service.dart b/lib/services/vault_service.dart
index 04fda4d..5d5df93 100644
--- a/lib/services/vault_service.dart
+++ b/lib/services/vault_service.dart
@@ -63,7 +63,7 @@ class VaultService {
 
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _vaultIndexKey = 'vault_file_index';
@@ -2458,6 +2458,69 @@ class VaultService {
       await _saveFileIndex();
     }
   }
+
+  Future<void> registerPasswordEntry({
+    required String passwordId,
+    required String title,
+    required String encryptedContentPath,
+    List<String> tags = const [],
+    bool isEncrypted = false,
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = 0,
+    bool isDecoy = false,
+  }) async {
+    final files = isDecoy
+        ? (_cachedDecoyFiles ??= await _loadFileIndex(isDecoy: true))
+        : (_cachedFiles ??= await _loadFileIndex());
+
+    final existingIndex =
+        files.indexWhere((f) => f.metadata?['passwordId'] == passwordId);
+
+    final entry = VaultedFile(
+      id: existingIndex != -1 ? files[existingIndex].id : passwordId,
+      originalName: '$title.pwd',
+      vaultPath: encryptedContentPath,
+      type: VaultedFileType.document,
+      mimeType: 'application/octet-stream',
+      fileSize: 0,
+      dateAdded: existingIndex != -1
+          ? files[existingIndex].dateAdded
+          : DateTime.now(),
+      dateModified: DateTime.now(),
+      tags: ['password', ...tags],
+      isEncrypted: isEncrypted,
+      encryptionAlgorithm: encryptionAlgorithm,
+      kdfIterations: kdfIterations,
+      metadata: {'passwordId': passwordId},
+    );
+
+    if (existingIndex != -1) {
+      files[existingIndex] = entry;
+    } else {
+      files.insert(0, entry);
+    }
+
+    if (isDecoy) {
+      await _saveFileIndex(isDecoy: true);
+    } else {
+      await _saveFileIndex();
+    }
+  }
+
+  Future<void> removePasswordEntry(String passwordId,
+      {bool isDecoy = false}) async {
+    final files = isDecoy
+        ? (_cachedDecoyFiles ??= await _loadFileIndex(isDecoy: true))
+        : (_cachedFiles ??= await _loadFileIndex());
+
+    files.removeWhere((f) => f.metadata?['passwordId'] == passwordId);
+
+    if (isDecoy) {
+      await _saveFileIndex(isDecoy: true);
+    } else {
+      await _saveFileIndex();
+    }
+  }
 }
 
 /// Helper class for batch file import
@@ -2520,8 +2583,8 @@ class VaultSettings {
 
   const VaultSettings({
     this.encryptionEnabled = false,
-    this.encryptionAlgorithm = EncryptionAlgorithm.aes256Ctr,
-    this.kdfIterations = 100000,
+    this.encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    this.kdfIterations = 600000,
     this.secureDelete = true,
     this.screenshotProtectionEnabled = false,
     this.autoKillDelaySeconds = 0,
@@ -2617,10 +2680,10 @@ class VaultSettings {
     return VaultSettings(
       encryptionEnabled: json['encryptionEnabled'] as bool? ?? false,
       encryptionAlgorithm: EncryptionAlgorithm.values.firstWhere(
-        (a) => a.name == (json['encryptionAlgorithm'] as String? ?? 'aes256Ctr'),
-        orElse: () => EncryptionAlgorithm.aes256Ctr,
+        (a) => a.name == (json['encryptionAlgorithm'] as String? ?? 'aes256Gcm'),
+        orElse: () => EncryptionAlgorithm.aes256Gcm,
       ),
-      kdfIterations: json['kdfIterations'] as int? ?? 100000,
+      kdfIterations: json['kdfIterations'] as int? ?? 600000,
       secureDelete: json['secureDelete'] as bool? ?? true,
       screenshotProtectionEnabled:
           json['screenshotProtectionEnabled'] as bool? ?? false,
diff --git a/lib/themes/app_colors.dart b/lib/themes/app_colors.dart
index 91d54f0..360967b 100644
--- a/lib/themes/app_colors.dart
+++ b/lib/themes/app_colors.dart
@@ -1,4 +1,5 @@
 import 'package:flutter/material.dart';
+import '../models/vaulted_file.dart';
 
 /// App Color Palette
 /// Contains all color definitions used throughout the Latch app
@@ -377,3 +378,51 @@ extension AppColorsExtension on BuildContext {
   /// Glass highlight color
   Color get glassHighlight => AppColors.glassHighlight;
 }
+
+/// Single source of truth for per-file-type colors/icons and status colors.
+/// Resolves the document green/orange divergence (now consistently orange).
+class FileTypeColors {
+  FileTypeColors._();
+
+  static const Color imageAccentFallback = Color(0xFF1976D2);
+  static const Color video = Colors.red;
+  static const Color song = Colors.purple;
+  static const Color document = Colors.orange;
+  static const Color other = Colors.grey;
+
+  /// Favorite/amber used for the star indicator across screens.
+  static const Color favorite = Colors.amber;
+
+  /// Color for a vaulted file type. Pass the theme accent for images, which
+  /// follow the dynamic accent color rather than a fixed value.
+  static Color colorForType(VaultedFileType type, {Color? accent}) {
+    switch (type) {
+      case VaultedFileType.image:
+        return accent ?? imageAccentFallback;
+      case VaultedFileType.video:
+        return video;
+      case VaultedFileType.song:
+        return song;
+      case VaultedFileType.document:
+        return document;
+      case VaultedFileType.other:
+        return other;
+    }
+  }
+
+  /// Icon for a vaulted file type.
+  static IconData iconForType(VaultedFileType type) {
+    switch (type) {
+      case VaultedFileType.image:
+        return Icons.image;
+      case VaultedFileType.video:
+        return Icons.videocam;
+      case VaultedFileType.song:
+        return Icons.music_note;
+      case VaultedFileType.document:
+        return Icons.description;
+      case VaultedFileType.other:
+        return Icons.insert_drive_file;
+    }
+  }
+}
diff --git a/lib/utils/argon2_isolate.dart b/lib/utils/argon2_isolate.dart
new file mode 100644
index 0000000..de7e1d4
--- /dev/null
+++ b/lib/utils/argon2_isolate.dart
@@ -0,0 +1,56 @@
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:pointycastle/export.dart';
+
+class _Argon2Args {
+  final String credential;
+  final Uint8List salt;
+  final int iterations;
+  final int memoryPowerOf2;
+  final int lanes;
+  final int keyLength;
+  const _Argon2Args(
+    this.credential,
+    this.salt,
+    this.iterations,
+    this.memoryPowerOf2,
+    this.lanes,
+    this.keyLength,
+  );
+}
+
+Uint8List _computeArgon2id(_Argon2Args args) {
+  final params = Argon2Parameters(
+    Argon2Parameters.ARGON2_id,
+    args.salt,
+    desiredKeyLength: args.keyLength,
+    iterations: args.iterations,
+    memoryPowerOf2: args.memoryPowerOf2,
+    lanes: args.lanes,
+    version: Argon2Parameters.ARGON2_VERSION_13,
+  );
+  final generator = Argon2BytesGenerator()..init(params);
+  return generator.process(Uint8List.fromList(utf8.encode(args.credential)));
+}
+
+Future<Uint8List> computeArgon2idHash(
+  String credential,
+  Uint8List salt, {
+  int iterations = 3,
+  int memoryPowerOf2 = 14,
+  int lanes = 1,
+  int keyLength = 32,
+}) {
+  return compute(
+    _computeArgon2id,
+    _Argon2Args(
+      credential,
+      salt,
+      iterations,
+      memoryPowerOf2,
+      lanes,
+      keyLength,
+    ),
+  );
+}
diff --git a/lib/utils/clipboard_util.dart b/lib/utils/clipboard_util.dart
new file mode 100644
index 0000000..ce62e47
--- /dev/null
+++ b/lib/utils/clipboard_util.dart
@@ -0,0 +1,31 @@
+import 'dart:async';
+
+import 'package:flutter/services.dart';
+
+class ClipboardUtil {
+  ClipboardUtil._();
+
+  static Timer? _clearTimer;
+  static String? _lastCopied;
+
+  static Future<void> copyWithAutoClear(
+    String text, {
+    int seconds = 20,
+  }) async {
+    _clearTimer?.cancel();
+    _lastCopied = text;
+    await Clipboard.setData(ClipboardData(text: text));
+    _clearTimer = Timer(Duration(seconds: seconds), () async {
+      final current = await Clipboard.getData('text/plain');
+      if (current?.text == _lastCopied) {
+        await Clipboard.setData(const ClipboardData(text: ''));
+      }
+      _lastCopied = null;
+    });
+  }
+
+  static void cancelClear() {
+    _clearTimer?.cancel();
+    _lastCopied = null;
+  }
+}
diff --git a/lib/utils/compression_helper.dart b/lib/utils/compression_helper.dart
deleted file mode 100644
index 6eef6cc..0000000
--- a/lib/utils/compression_helper.dart
+++ /dev/null
@@ -1,188 +0,0 @@
-import 'dart:io';
-import 'package:flutter/material.dart';
-import 'package:video_compress/video_compress.dart';
-import '../services/media_compression_service.dart';
-import '../widgets/compression_options_dialog.dart';
-
-/// Helper class for handling media compression in import flows
-class CompressionHelper {
-  /// Show compression options dialog and return selected option
-  static Future<CompressionOption?> showCompressionDialog(
-    BuildContext context, {
-    required bool isVideo,
-  }) async {
-    return await showDialog<CompressionOption>(
-      context: context,
-      builder: (context) => CompressionOptionsDialog(isVideo: isVideo),
-    );
-  }
-
-  /// Compress image file based on selected option
-  static Future<String?> compressImageIfNeeded({
-    required String sourcePath,
-    required CompressionOption option,
-    Function(String message)? onStatusUpdate,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePath;
-    }
-
-    onStatusUpdate?.call('Compressing image...');
-
-    final result = await MediaCompressionService.instance.compressImage(
-      sourcePath: sourcePath,
-      quality: option.imageQuality,
-    );
-
-    if (result != null) {
-      onStatusUpdate?.call(
-        'Compressed: ${result.formattedOriginalSize} → ${result.formattedCompressedSize} (${result.formattedRatio} saved)',
-      );
-      return result.compressedPath;
-    }
-
-    return sourcePath;
-  }
-
-  /// Compress video file based on selected option
-  static Future<String?> compressVideoIfNeeded({
-    required String sourcePath,
-    required CompressionOption option,
-    Function(String message)? onStatusUpdate,
-    Function(double progress)? onProgress,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePath;
-    }
-
-    onStatusUpdate?.call('Compressing video...');
-
-    VideoQuality quality;
-    switch (option) {
-      case CompressionOption.low:
-        quality = VideoQuality.HighestQuality;
-        break;
-      case CompressionOption.medium:
-        quality = VideoQuality.DefaultQuality;
-        break;
-      case CompressionOption.high:
-        quality = VideoQuality.LowQuality;
-        break;
-      default:
-        quality = VideoQuality.DefaultQuality;
-    }
-
-    final result = await MediaCompressionService.instance.compressVideo(
-      sourcePath: sourcePath,
-      quality: quality,
-      onProgress: onProgress,
-    );
-
-    if (result != null) {
-      onStatusUpdate?.call(
-        'Compressed: ${result.formattedOriginalSize} → ${result.formattedCompressedSize} (${result.formattedRatio} saved)',
-      );
-      return result.compressedPath;
-    }
-
-    return sourcePath;
-  }
-
-  /// Compress multiple images
-  static Future<List<String>> compressImagesIfNeeded({
-    required List<String> sourcePaths,
-    required CompressionOption option,
-    Function(int current, int total)? onProgress,
-    Function(String message)? onStatusUpdate,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePaths;
-    }
-
-    final compressedPaths = <String>[];
-    
-    for (int i = 0; i < sourcePaths.length; i++) {
-      onStatusUpdate?.call('Compressing image ${i + 1}/${sourcePaths.length}...');
-      onProgress?.call(i + 1, sourcePaths.length);
-
-      final compressed = await compressImageIfNeeded(
-        sourcePath: sourcePaths[i],
-        option: option,
-      );
-
-      compressedPaths.add(compressed ?? sourcePaths[i]);
-    }
-
-    return compressedPaths;
-  }
-
-  /// Compress multiple videos
-  static Future<List<String>> compressVideosIfNeeded({
-    required List<String> sourcePaths,
-    required CompressionOption option,
-    Function(int current, int total)? onProgress,
-    Function(String message)? onStatusUpdate,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePaths;
-    }
-
-    final compressedPaths = <String>[];
-    
-    for (int i = 0; i < sourcePaths.length; i++) {
-      onStatusUpdate?.call('Compressing video ${i + 1}/${sourcePaths.length}...');
-
-      final compressed = await compressVideoIfNeeded(
-        sourcePath: sourcePaths[i],
-        option: option,
-        onProgress: (progress) {
-          onProgress?.call(i, sourcePaths.length);
-        },
-      );
-
-      compressedPaths.add(compressed ?? sourcePaths[i]);
-    }
-
-    return compressedPaths;
-  }
-
-  /// Show compression progress dialog
-  static Future<T?> showCompressionProgress<T>({
-    required BuildContext context,
-    required Future<T> Function() operation,
-    String title = 'Compressing...',
-  }) async {
-    return await showDialog<T>(
-      context: context,
-      barrierDismissible: false,
-      builder: (context) => WillPopScope(
-        onWillPop: () async => false,
-        child: AlertDialog(
-          title: Text(title),
-          content: Column(
-            mainAxisSize: MainAxisSize.min,
-            children: [
-              CircularProgressIndicator(),
-              SizedBox(height: 16),
-              Text('Please wait...'),
-            ],
-          ),
-        ),
-      ),
-    );
-  }
-
-  /// Clean up temporary compressed files
-  static Future<void> cleanupTempFiles(List<String> paths) async {
-    for (final path in paths) {
-      try {
-        final file = File(path);
-        if (await file.exists() && path.contains('compressed_')) {
-          await file.delete();
-        }
-      } catch (e) {
-        debugPrint('[CompressionHelper] Error deleting temp file: $e');
-      }
-    }
-  }
-}
diff --git a/lib/utils/navigator_key.dart b/lib/utils/navigator_key.dart
new file mode 100644
index 0000000..5691d87
--- /dev/null
+++ b/lib/utils/navigator_key.dart
@@ -0,0 +1,3 @@
+import 'package:flutter/material.dart';
+
+final GlobalKey<NavigatorState> navigatorKey = GlobalKey<NavigatorState>();
diff --git a/lib/utils/path_utils.dart b/lib/utils/path_utils.dart
new file mode 100644
index 0000000..206d8c3
--- /dev/null
+++ b/lib/utils/path_utils.dart
@@ -0,0 +1,36 @@
+import 'dart:io';
+import 'package:path_provider/path_provider.dart' as pp;
+
+/// Centralized Android/public-storage path resolution.
+///
+/// Absolute Android paths don't exist on all OEM ROMs and bypass scoped
+/// storage on Android 11+. Everything routes through here so the fallback
+/// logic lives in one place.
+class PathUtils {
+  PathUtils._();
+
+  /// Public primary external storage root on Android (may not exist on all
+  /// ROMs / scoped-storage builds).
+  static const String androidStorageRoot = '/storage/emulated/0';
+
+  /// Resolve a writable Downloads directory.
+  /// On Android tries the canonical public Downloads path first, falling back
+  /// to the scoped external-storage dir if absent.
+  static Future<Directory?> getDownloadsDirectory() async {
+    if (Platform.isAndroid) {
+      final primary = Directory('$androidStorageRoot/Download');
+      if (await primary.exists()) return primary;
+      return pp.getExternalStorageDirectory();
+    }
+    return pp.getDownloadsDirectory();
+  }
+
+  /// Common Android document/media source roots to seed a picker.
+  static const List<String> androidSourceRoots = [
+    '$androidStorageRoot/Download',
+    '$androidStorageRoot/Documents',
+    '$androidStorageRoot/DCIM',
+    '/sdcard/Download',
+    '/sdcard/Documents',
+  ];
+}
diff --git a/lib/utils/pbkdf2_isolate.dart b/lib/utils/pbkdf2_isolate.dart
index a36fbf2..d1ef233 100644
--- a/lib/utils/pbkdf2_isolate.dart
+++ b/lib/utils/pbkdf2_isolate.dart
@@ -21,7 +21,7 @@ String _computePbkdf2(_Pbkdf2Args args) {
 Future<String> computePbkdf2Hash(
   String credential,
   Uint8List salt, {
-  int iterations = 100000,
+  int iterations = 600000,
   int keyLength = 32,
 }) {
   return compute(
diff --git a/lib/utils/secure_compare.dart b/lib/utils/secure_compare.dart
new file mode 100644
index 0000000..f89a6e9
--- /dev/null
+++ b/lib/utils/secure_compare.dart
@@ -0,0 +1,14 @@
+/// Constant-time equality for secret-derived hash strings.
+///
+/// ponytail: lengths are still observable (unavoidable for variable-length
+/// strings), but per-character comparison never short-circuits on mismatch.
+bool constantTimeEquals(String a, String b) {
+  final aLen = a.length;
+  final bLen = b.length;
+  var diff = aLen ^ bLen;
+  final min = aLen < bLen ? aLen : bLen;
+  for (var i = 0; i < min; i++) {
+    diff |= a.codeUnitAt(i) ^ b.codeUnitAt(i);
+  }
+  return diff == 0;
+}
diff --git a/lib/utils/toast_utils.dart b/lib/utils/toast_utils.dart
index 51c3186..0ef4d20 100644
--- a/lib/utils/toast_utils.dart
+++ b/lib/utils/toast_utils.dart
@@ -1,68 +1,43 @@
 import 'package:flutter/material.dart';
 import 'package:locker/themes/app_colors.dart';
-import 'package:fluttertoast/fluttertoast.dart';
+import 'navigator_key.dart';
 
 class ToastUtils {
-  static const Color _toastBg = AppColors.primaryBackground;
-  static const Color _lightText = AppColors.primaryText;
-
-  static void showToast(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 1,
-      backgroundColor: _toastBg,
-      textColor: _lightText,
-      fontSize: 16,
-    );
+  static void _show(
+    String message, {
+    Color? backgroundColor,
+    Duration duration = const Duration(seconds: 2),
+  }) {
+    final context = navigatorKey.currentContext;
+    if (context == null) return;
+    final messenger = ScaffoldMessenger.maybeOf(context);
+    if (messenger == null) return;
+    messenger
+      ..clearSnackBars()
+      ..showSnackBar(
+        SnackBar(
+          content: Text(message),
+          backgroundColor: backgroundColor,
+          behavior: SnackBarBehavior.floating,
+          duration: duration,
+        ),
+      );
   }
 
-  static void showSuccess(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 2,
-      backgroundColor: AppColors.success,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showToast(String message) => _show(message);
 
-  static void showError(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_LONG,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 3,
-      backgroundColor: AppColors.error,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showSuccess(String message) =>
+      _show(message, backgroundColor: AppColors.success);
 
-  static void showInfo(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 2,
-      backgroundColor: AppColors.info,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showError(String message) => _show(
+        message,
+        backgroundColor: AppColors.error,
+        duration: const Duration(seconds: 3),
+      );
 
-  static void showWarning(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 2,
-      backgroundColor: AppColors.warning,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showInfo(String message) =>
+      _show(message, backgroundColor: AppColors.info);
+
+  static void showWarning(String message) =>
+      _show(message, backgroundColor: AppColors.warning);
 }
diff --git a/lib/widgets/explorer_file_grid.dart b/lib/widgets/explorer_file_grid.dart
index d15b619..3a4e337 100644
--- a/lib/widgets/explorer_file_grid.dart
+++ b/lib/widgets/explorer_file_grid.dart
@@ -3,7 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vault_folder.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
@@ -811,15 +811,7 @@ class ExplorerFileGrid extends ConsumerWidget {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (ctx.mounted) Navigator.pop(ctx);
diff --git a/lib/widgets/password_card.dart b/lib/widgets/password_card.dart
new file mode 100644
index 0000000..25b6e56
--- /dev/null
+++ b/lib/widgets/password_card.dart
@@ -0,0 +1,125 @@
+import 'package:flutter/material.dart';
+
+import '../models/password_entry.dart';
+import '../themes/app_colors.dart';
+
+class PasswordCard extends StatelessWidget {
+  final PasswordEntry entry;
+  final VoidCallback? onTap;
+  final VoidCallback? onLongPress;
+  final bool isSelected;
+
+  const PasswordCard({
+    super.key,
+    required this.entry,
+    this.onTap,
+    this.onLongPress,
+    this.isSelected = false,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return GestureDetector(
+      onTap: onTap,
+      onLongPress: onLongPress,
+      child: Container(
+        decoration: BoxDecoration(
+          color: isSelected
+              ? context.accentColor.withValues(alpha: 0.15)
+              : context.surfaceColor,
+          borderRadius: BorderRadius.circular(12),
+          border: Border.all(
+            color: isSelected ? context.accentColor : context.borderColor,
+            width: isSelected ? 2 : 1,
+          ),
+        ),
+        child: Padding(
+          padding: const EdgeInsets.all(14),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Row(
+                children: [
+                  Icon(
+                    Icons.lock_outline,
+                    size: 16,
+                    color: context.textTertiary,
+                  ),
+                  const SizedBox(width: 6),
+                  if (entry.isFavorite)
+                    Padding(
+                      padding: const EdgeInsets.only(right: 6),
+                      child: Icon(
+                        Icons.star,
+                        size: 14,
+                        color: context.accentColor,
+                      ),
+                    ),
+                  Expanded(
+                    child: Text(
+                      entry.title,
+                      style: TextStyle(
+                        fontFamily: 'ProductSans',
+                        fontSize: 15,
+                        fontWeight: FontWeight.w600,
+                        color: context.textPrimary,
+                      ),
+                      maxLines: 1,
+                      overflow: TextOverflow.ellipsis,
+                    ),
+                  ),
+                ],
+              ),
+              if (entry.tags.isNotEmpty) ...[
+                const SizedBox(height: 8),
+                Wrap(
+                  spacing: 4,
+                  runSpacing: 4,
+                  children: entry.tags.take(3).map((t) {
+                    return Container(
+                      padding: const EdgeInsets.symmetric(
+                        horizontal: 8,
+                        vertical: 2,
+                      ),
+                      decoration: BoxDecoration(
+                        color: context.accentColor.withValues(alpha: 0.12),
+                        borderRadius: BorderRadius.circular(6),
+                      ),
+                      child: Text(
+                        t,
+                        style: TextStyle(
+                          fontFamily: 'ProductSans',
+                          fontSize: 10,
+                          color: context.accentColor,
+                        ),
+                      ),
+                    );
+                  }).toList(),
+                ),
+              ],
+              const SizedBox(height: 8),
+              Text(
+                _formatDate(entry.updatedAt),
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 12,
+                  color: context.textTertiary,
+                ),
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+
+  String _formatDate(DateTime date) {
+    final now = DateTime.now();
+    final diff = now.difference(date);
+    if (diff.inMinutes < 1) return 'Just now';
+    if (diff.inHours < 1) return '${diff.inMinutes}m ago';
+    if (diff.inDays < 1) return '${diff.inHours}h ago';
+    if (diff.inDays < 7) return '${diff.inDays}d ago';
+    return '${date.day}/${date.month}/${date.year}';
+  }
+}
diff --git a/lib/widgets/password_generator_sheet.dart b/lib/widgets/password_generator_sheet.dart
new file mode 100644
index 0000000..6634a40
--- /dev/null
+++ b/lib/widgets/password_generator_sheet.dart
@@ -0,0 +1,316 @@
+import 'dart:math';
+
+import 'package:flutter/material.dart';
+
+import '../themes/app_colors.dart';
+
+class PasswordGeneratorSheet extends StatefulWidget {
+  final void Function(String password) onGenerate;
+
+  const PasswordGeneratorSheet({
+    super.key,
+    required this.onGenerate,
+  });
+
+  @override
+  State<PasswordGeneratorSheet> createState() => _PasswordGeneratorSheetState();
+}
+
+class _PasswordGeneratorSheetState extends State<PasswordGeneratorSheet> {
+  double _length = 20;
+  bool _useUpper = true;
+  bool _useLower = true;
+  bool _useDigits = true;
+  bool _useSymbols = true;
+  bool _excludeAmbiguous = true;
+  String _generated = '';
+
+  static const String _upper = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  static const String _lower = 'abcdefghijklmnopqrstuvwxyz';
+  static const String _digits = '0123456789';
+  static const String _symbols = '!@#\$%^&*()-_=+[]{}|;:,.<>?';
+  static const String _ambiguous = 'Il1O0o';
+
+  String get _charset {
+    final chars = StringBuffer();
+    if (_useUpper) chars.write(_upper);
+    if (_useLower) chars.write(_lower);
+    if (_useDigits) chars.write(_digits);
+    if (_useSymbols) chars.write(_symbols);
+    var result = chars.toString();
+    if (_excludeAmbiguous) {
+      result = result.split('').where((c) => !_ambiguous.contains(c)).join();
+    }
+    return result;
+  }
+
+  void _generate() {
+    final charset = _charset;
+    if (charset.isEmpty) {
+      setState(() => _generated = '');
+      return;
+    }
+    final random = Random.secure();
+    final values =
+        List<int>.generate(_length.round(), (_) => random.nextInt(charset.length));
+    setState(() {
+      _generated = String.fromCharCodes(
+        values.map((i) => charset.codeUnitAt(i)),
+      );
+    });
+  }
+
+  String get _strengthLabel {
+    final len = _generated.length;
+    if (len == 0) return '';
+    final pool = _charset.length;
+    final entropy = len * (log(pool) / log(2));
+    if (entropy < 40) return 'Weak';
+    if (entropy < 60) return 'Fair';
+    if (entropy < 80) return 'Strong';
+    return 'Very Strong';
+  }
+
+  Color get _strengthColor {
+    final len = _generated.length;
+    if (len == 0) return Colors.grey;
+    final pool = _charset.length;
+    final entropy = len * (log(pool) / log(2));
+    if (entropy < 40) return AppColors.darkError;
+    if (entropy < 60) return AppColors.darkWarning;
+    if (entropy < 80) return AppColors.darkSuccess;
+    return AppColors.darkSuccess;
+  }
+
+  @override
+  void initState() {
+    super.initState();
+    _generate();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Padding(
+      padding: EdgeInsets.only(
+        left: 20,
+        right: 20,
+        bottom: MediaQuery.of(context).viewInsets.bottom + 20,
+        top: 20,
+      ),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(
+            'Password Generator',
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 18,
+              fontWeight: FontWeight.bold,
+              color: context.textPrimary,
+            ),
+          ),
+          const SizedBox(height: 16),
+          _buildPreview(),
+          const SizedBox(height: 16),
+          _buildLengthSlider(),
+          const SizedBox(height: 12),
+          _buildToggleRow('Uppercase (A-Z)', _useUpper, (v) {
+            setState(() => _useUpper = v);
+            _generate();
+          }),
+          _buildToggleRow('Lowercase (a-z)', _useLower, (v) {
+            setState(() => _useLower = v);
+            _generate();
+          }),
+          _buildToggleRow('Digits (0-9)', _useDigits, (v) {
+            setState(() => _useDigits = v);
+            _generate();
+          }),
+          _buildToggleRow('Symbols (!@#...)', _useSymbols, (v) {
+            setState(() => _useSymbols = v);
+            _generate();
+          }),
+          _buildToggleRow('Exclude ambiguous (Il1O0o)',
+              _excludeAmbiguous, (v) {
+            setState(() => _excludeAmbiguous = v);
+            _generate();
+          }),
+          const SizedBox(height: 20),
+          Row(
+            children: [
+              Expanded(
+                child: OutlinedButton.icon(
+                  onPressed: _generate,
+                  icon: const Icon(Icons.refresh),
+                  label: const Text('Regenerate'),
+                  style: OutlinedButton.styleFrom(
+                    foregroundColor: context.accentColor,
+                    side: BorderSide(color: context.borderColor),
+                    padding: const EdgeInsets.symmetric(vertical: 14),
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(12),
+                    ),
+                  ),
+                ),
+              ),
+              const SizedBox(width: 12),
+              Expanded(
+                child: FilledButton.icon(
+                  onPressed: _generated.isEmpty
+                      ? null
+                      : () {
+                          widget.onGenerate(_generated);
+                          Navigator.pop(context);
+                        },
+                  icon: const Icon(Icons.check),
+                  label: const Text('Use'),
+                  style: FilledButton.styleFrom(
+                    backgroundColor: context.accentColor,
+                    padding: const EdgeInsets.symmetric(vertical: 14),
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(12),
+                    ),
+                  ),
+                ),
+              ),
+            ],
+          ),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildPreview() {
+    return Container(
+      width: double.infinity,
+      padding: const EdgeInsets.all(16),
+      decoration: BoxDecoration(
+        color: context.surfaceColor,
+        borderRadius: BorderRadius.circular(12),
+        border: Border.all(color: context.borderColor),
+      ),
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(
+            _generated.isEmpty ? 'Select at least one charset' : _generated,
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 16,
+              fontWeight: FontWeight.w600,
+              color: _generated.isEmpty
+                  ? context.textTertiary
+                  : context.textPrimary,
+            ),
+          ),
+          if (_generated.isNotEmpty) ...[
+            const SizedBox(height: 8),
+            Row(
+              children: [
+                Text(
+                  _strengthLabel,
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 12,
+                    fontWeight: FontWeight.w600,
+                    color: _strengthColor,
+                  ),
+                ),
+                const SizedBox(width: 8),
+                Expanded(
+                  child: ClipRRect(
+                    borderRadius: BorderRadius.circular(4),
+                    child: LinearProgressIndicator(
+                      value: _strengthProgress,
+                      backgroundColor: context.borderColor,
+                      valueColor: AlwaysStoppedAnimation(_strengthColor),
+                      minHeight: 4,
+                    ),
+                  ),
+                ),
+              ],
+            ),
+          ],
+        ],
+      ),
+    );
+  }
+
+  double get _strengthProgress {
+    final len = _generated.length;
+    if (len == 0) return 0;
+    final pool = _charset.length;
+    final entropy = len * (log(pool) / log(2));
+    return (entropy / 120).clamp(0.0, 1.0);
+  }
+
+  Widget _buildLengthSlider() {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Row(
+          mainAxisAlignment: MainAxisAlignment.spaceBetween,
+          children: [
+            Text(
+              'Length',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                color: context.textSecondary,
+              ),
+            ),
+            Text(
+              '${_length.round()}',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                fontWeight: FontWeight.bold,
+                color: context.accentColor,
+              ),
+            ),
+          ],
+        ),
+        Slider(
+          value: _length,
+          min: 8,
+          max: 64,
+          divisions: 56,
+          activeColor: context.accentColor,
+          onChanged: (v) {
+            setState(() => _length = v);
+            _generate();
+          },
+        ),
+      ],
+    );
+  }
+
+  Widget _buildToggleRow(
+    String label,
+    bool value,
+    ValueChanged<bool> onChanged,
+  ) {
+    return Padding(
+      padding: const EdgeInsets.symmetric(vertical: 2),
+      child: Row(
+        mainAxisAlignment: MainAxisAlignment.spaceBetween,
+        children: [
+          Text(
+            label,
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 14,
+              color: context.textSecondary,
+            ),
+          ),
+          Switch(
+            value: value,
+            onChanged: onChanged,
+            activeThumbColor: context.accentColor,
+          ),
+        ],
+      ),
+    );
+  }
+}
diff --git a/pubspec.lock b/pubspec.lock
index 5b17c0b..d7104ef 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -33,14 +33,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.7.0"
-  asn1lib:
-    dependency: transitive
-    description:
-      name: asn1lib
-      sha256: "9a8f69025044eb466b9b60ef3bc3ac99b4dc6c158ae9c56d25eeccf5bc56d024"
-      url: "https://pub.dev"
-    source: hosted
-    version: "1.6.5"
   async:
     dependency: transitive
     description:
@@ -217,14 +209,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.2"
-  cupertino_icons:
-    dependency: "direct main"
-    description:
-      name: cupertino_icons
-      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
-      url: "https://pub.dev"
-    source: hosted
-    version: "1.0.9"
   dbus:
     dependency: transitive
     description:
@@ -233,14 +217,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.7.12"
-  encrypt:
+  device_info_plus:
     dependency: "direct main"
     description:
-      name: encrypt
-      sha256: "62d9aa4670cc2a8798bab89b39fc71b6dfbacf615de6cf5001fb39f7e4a996a2"
+      name: device_info_plus
+      sha256: "98f28b42168cc509abc92f88518882fd58061ea372d7999aecc424345c7bff6a"
       url: "https://pub.dev"
     source: hosted
-    version: "5.0.3"
+    version: "11.5.0"
+  device_info_plus_platform_interface:
+    dependency: transitive
+    description:
+      name: device_info_plus_platform_interface
+      sha256: e1ea89119e34903dca74b883d0dd78eb762814f97fb6c76f35e9ff74d261a18f
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.0.3"
   fake_async:
     dependency: transitive
     description:
@@ -480,14 +472,6 @@ packages:
     description: flutter
     source: sdk
     version: "0.0.0"
-  fluttertoast:
-    dependency: "direct main"
-    description:
-      name: fluttertoast
-      sha256: "144ddd74d49c865eba47abe31cbc746c7b311c82d6c32e571fd73c4264b740e2"
-      url: "https://pub.dev"
-    source: hosted
-    version: "9.0.0"
   frontend_server_client:
     dependency: transitive
     description:
@@ -1525,6 +1509,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "5.15.0"
+  win32_registry:
+    dependency: transitive
+    description:
+      name: win32_registry
+      sha256: "6f1b564492d0147b330dd794fee8f512cec4977957f310f9951b5f9d83618dae"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
   xdg_directories:
     dependency: transitive
     description:
diff --git a/pubspec.yaml b/pubspec.yaml
index bc6deef..80a2a22 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -14,7 +14,7 @@ publish_to: "none"
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 0.14.4-beta.4+15
+version: 0.14.4-beta.5+15
 
 environment:
   sdk: ">=3.4.4 <4.0.0"
@@ -29,8 +29,7 @@ dependencies:
   archive: ^4.0.7
   camera: ^0.12.0
   crypto: ^3.0.7
-  cupertino_icons: ^1.0.6
-  encrypt: ^5.0.3
+  device_info_plus: ^11.3.0
   file_picker: ^11.0.1
   flutter:
     sdk: flutter
@@ -40,7 +39,6 @@ dependencies:
   flutter_riverpod: ^3.0.3
   flutter_secure_storage: ^10.0.0
   flutter_svg: ^2.0.10
-  fluttertoast: ^9.0.0
   image: ^4.8.0
   image_picker: ^1.2.1
   just_audio: ^0.10.5
diff --git a/test/crypto_hygiene_test.dart b/test/crypto_hygiene_test.dart
new file mode 100644
index 0000000..85e8776
--- /dev/null
+++ b/test/crypto_hygiene_test.dart
@@ -0,0 +1,45 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:locker/services/auth_service.dart';
+import 'package:locker/utils/secure_compare.dart';
+
+void main() {
+  group('constantTimeEquals', () {
+    test('equal strings match', () {
+      expect(constantTimeEquals('abc123', 'abc123'), isTrue);
+    });
+
+    test('different strings do not match', () {
+      expect(constantTimeEquals('abc123', 'abc124'), isFalse);
+    });
+
+    test('different lengths do not match', () {
+      expect(constantTimeEquals('abc', 'abcd'), isFalse);
+    });
+
+    test('empty strings match', () {
+      expect(constantTimeEquals('', ''), isTrue);
+    });
+  });
+
+  group('AuthService.validatePasswordStrength', () {
+    test('rejects below minimum length', () {
+      expect(AuthService.validatePasswordStrength('Ab1!'),
+          PasswordStrength.tooShort);
+    });
+
+    test('flags short single-class as weak', () {
+      expect(AuthService.validatePasswordStrength('abcdefgh'),
+          PasswordStrength.weak);
+    });
+
+    test('accepts short multi-class', () {
+      expect(AuthService.validatePasswordStrength('Abcd1234'),
+          PasswordStrength.acceptable);
+    });
+
+    test('accepts long single-class passphrase', () {
+      expect(AuthService.validatePasswordStrength('longpassphraseonly'),
+          PasswordStrength.acceptable);
+    });
+  });
+}
diff --git a/test/encryption_service_test.dart b/test/encryption_service_test.dart
new file mode 100644
index 0000000..f7b2a58
--- /dev/null
+++ b/test/encryption_service_test.dart
@@ -0,0 +1,85 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:locker/services/encryption_service.dart';
+import 'package:pointycastle/export.dart';
+
+void main() {
+  final key = Uint8List.fromList(List.generate(32, (i) => i));
+  final iv = Uint8List.fromList(List.generate(16, (i) => i + 100));
+  final plaintext = Uint8List.fromList(
+      utf8.encode('Latch vault test plaintext — round trip!'));
+
+  group('AES-256-GCM round-trip', () {
+    test('encrypt then decryptDataGcm returns original', () async {
+      final gcm = GCMBlockCipher(AESEngine())
+        ..init(true, AEADParameters(KeyParameter(key), 128, iv, Uint8List(0)));
+      final encrypted = gcm.process(plaintext);
+
+      final result = await EncryptionService.instance.decryptDataGcm(
+        encrypted,
+        base64Encode(iv),
+        customKey: key,
+      );
+
+      expect(result.success, true);
+      expect(result.data, plaintext);
+    });
+
+    test('tampered ciphertext fails GCM authentication', () async {
+      final gcm = GCMBlockCipher(AESEngine())
+        ..init(true, AEADParameters(KeyParameter(key), 128, iv, Uint8List(0)));
+      final encrypted = gcm.process(plaintext);
+
+      encrypted[0] ^= 0xFF;
+
+      final result = await EncryptionService.instance.decryptDataGcm(
+        encrypted,
+        base64Encode(iv),
+        customKey: key,
+      );
+
+      expect(result.success, false);
+    });
+
+    test('file-based GCM round-trip (encryptBytesStreamedGcm → decryptStreamedFileToMemoryGcm)',
+        () async {
+      final tmpDir = await Directory.systemTemp.createTemp('latch_gcm_test');
+      final encPath = '${tmpDir.path}/test.enc';
+
+      final encResult = await EncryptionService.instance
+          .encryptBytesStreamedGcm(plaintext, encPath, derivedKey: key);
+
+      expect(encResult.success, true);
+      expect(encResult.iv, isNotNull);
+
+      final decResult = await EncryptionService.instance
+          .decryptStreamedFileToMemoryGcm(
+        encPath,
+        encResult.iv!,
+        derivedKey: key,
+      );
+
+      expect(decResult.success, true);
+      expect(decResult.data, plaintext);
+
+      await tmpDir.delete(recursive: true);
+    });
+  });
+
+  group('AES-256-CTR round-trip', () {
+    test('encrypt then decrypt returns original', () {
+      final ctr = CTRStreamCipher(AESEngine())
+        ..init(true, ParametersWithIV(KeyParameter(key), iv));
+      final encrypted = ctr.process(plaintext);
+
+      final decCtr = CTRStreamCipher(AESEngine())
+        ..init(false, ParametersWithIV(KeyParameter(key), iv));
+      final decrypted = decCtr.process(encrypted);
+
+      expect(decrypted, plaintext);
+    });
+  });
+}
diff --git a/test/h1_key_wrapping_test.dart b/test/h1_key_wrapping_test.dart
new file mode 100644
index 0000000..d9b3135
--- /dev/null
+++ b/test/h1_key_wrapping_test.dart
@@ -0,0 +1,163 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:pointycastle/export.dart';
+
+import 'package:locker/utils/argon2_isolate.dart';
+
+void main() {
+  group('Argon2id KWK derivation', () {
+    test('is deterministic — same credential + salt → same KWK', () async {
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk1 = await computeArgon2idHash(
+        'testPassword123',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwk2 = await computeArgon2idHash(
+        'testPassword123',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(base64Encode(kwk1), equals(base64Encode(kwk2)));
+    });
+
+    test('different credentials produce different KWKs', () async {
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk1 = await computeArgon2idHash(
+        'password1',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwk2 = await computeArgon2idHash(
+        'password2',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(base64Encode(kwk1), isNot(equals(base64Encode(kwk2))));
+    });
+
+    test('different salts produce different KWKs', () async {
+      final salt1 = Uint8List.fromList(List.generate(32, (i) => i));
+      final salt2 = Uint8List.fromList(List.generate(32, (i) => i + 100));
+      final kwk1 = await computeArgon2idHash(
+        'samePassword',
+        salt1,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwk2 = await computeArgon2idHash(
+        'samePassword',
+        salt2,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(base64Encode(kwk1), isNot(equals(base64Encode(kwk2))));
+    });
+
+    test('produces 32-byte key', () async {
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk = await computeArgon2idHash(
+        'test',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(kwk.length, equals(32));
+    });
+  });
+
+  group('Key wrap/unwrap (AES-256-GCM)', () {
+    Uint8List wrapKey(Uint8List masterKey, Uint8List kwk, Uint8List iv) {
+      final cipher = GCMBlockCipher(AESEngine());
+      cipher.init(
+        true,
+        AEADParameters(KeyParameter(kwk), 128, iv, Uint8List(0)),
+      );
+      return cipher.process(masterKey);
+    }
+
+    Uint8List unwrapKey(Uint8List wrappedKey, Uint8List kwk, Uint8List iv) {
+      final cipher = GCMBlockCipher(AESEngine());
+      cipher.init(
+        false,
+        AEADParameters(KeyParameter(kwk), 128, iv, Uint8List(0)),
+      );
+      return cipher.process(wrappedKey);
+    }
+
+    test('wrap then unwrap returns original master key', () async {
+      final masterKey = Uint8List.fromList(
+        List.generate(32, (i) => i * 7 + 3),
+      );
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk = await computeArgon2idHash(
+        'mySecretPassword',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final iv = Uint8List.fromList(List.generate(16, (i) => i + 50));
+
+      final wrappedKey = wrapKey(masterKey, kwk, iv);
+      final unwrappedKey = unwrapKey(wrappedKey, kwk, iv);
+
+      expect(base64Encode(unwrappedKey), equals(base64Encode(masterKey)));
+    });
+
+    test('unwrap with wrong KWK fails (GCM authentication)', () async {
+      final masterKey = Uint8List.fromList(
+        List.generate(32, (i) => i * 7 + 3),
+      );
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwkCorrect = await computeArgon2idHash(
+        'correctPassword',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwkWrong = await computeArgon2idHash(
+        'wrongPassword',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final iv = Uint8List.fromList(List.generate(16, (i) => i + 50));
+
+      final wrappedKey = wrapKey(masterKey, kwkCorrect, iv);
+
+      expect(
+        () => unwrapKey(wrappedKey, kwkWrong, iv),
+        throwsA(isA<Object>()),
+      );
+    });
+
+    test('unwrap with tampered wrapped key fails', () async {
+      final masterKey = Uint8List.fromList(
+        List.generate(32, (i) => i * 7 + 3),
+      );
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk = await computeArgon2idHash(
+        'password',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final iv = Uint8List.fromList(List.generate(16, (i) => i + 50));
+
+      final wrappedKey = wrapKey(masterKey, kwk, iv);
+      final tamperedKey = Uint8List.fromList(wrappedKey);
+      tamperedKey[0] ^= 0xFF;
+
+      expect(
+        () => unwrapKey(tamperedKey, kwk, iv),
+        throwsA(isA<Object>()),
+      );
+    });
+  });
+}
diff --git a/test/pbkdf2_isolate_test.dart b/test/pbkdf2_isolate_test.dart
new file mode 100644
index 0000000..284bdf0
--- /dev/null
+++ b/test/pbkdf2_isolate_test.dart
@@ -0,0 +1,82 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:locker/utils/pbkdf2_isolate.dart';
+import 'package:pointycastle/export.dart';
+
+void main() {
+  group('PBKDF2-HMAC-SHA256', () {
+    test('computePbkdf2Hash is deterministic', () async {
+      final salt = Uint8List.fromList(List.generate(16, (i) => i));
+
+      final hash1 = await computePbkdf2Hash(
+        'password123',
+        salt,
+        iterations: 10000,
+      );
+      final hash2 = await computePbkdf2Hash(
+        'password123',
+        salt,
+        iterations: 10000,
+      );
+
+      expect(hash1, hash2);
+    });
+
+    test('different passwords produce different hashes', () async {
+      final salt = Uint8List.fromList(List.generate(16, (i) => i));
+
+      final hash1 = await computePbkdf2Hash(
+        'password123',
+        salt,
+        iterations: 10000,
+      );
+      final hash2 = await computePbkdf2Hash(
+        'password456',
+        salt,
+        iterations: 10000,
+      );
+
+      expect(hash1, isNot(hash2));
+    });
+
+    test('different salts produce different hashes', () async {
+      final salt1 = Uint8List.fromList(List.generate(16, (i) => i));
+      final salt2 = Uint8List.fromList(List.generate(16, (i) => i + 1));
+
+      final hash1 = await computePbkdf2Hash(
+        'password123',
+        salt1,
+        iterations: 10000,
+      );
+      final hash2 = await computePbkdf2Hash(
+        'password123',
+        salt2,
+        iterations: 10000,
+      );
+
+      expect(hash1, isNot(hash2));
+    });
+
+    test('matches direct pointycastle computation', () async {
+      final salt = Uint8List.fromList(utf8.encode('saltsaltsaltsalt'));
+      const password = 'testPassword';
+      const iterations = 10000;
+
+      final isolateHash = await computePbkdf2Hash(
+        password,
+        salt,
+        iterations: iterations,
+      );
+
+      final pbkdf2 = PBKDF2KeyDerivator(HMac(SHA256Digest(), 64))
+        ..init(Pbkdf2Parameters(salt, iterations, 32));
+      final directHash = base64Encode(
+        pbkdf2.process(Uint8List.fromList(utf8.encode(password))),
+      );
+
+      expect(isolateHash, directHash);
+    });
+  });
+}
diff --git a/test/widget_test.dart b/test/widget_test.dart
deleted file mode 100644
index 9322cd7..0000000
--- a/test/widget_test.dart
+++ /dev/null
@@ -1,28 +0,0 @@
-// This is a basic Flutter widget test.
-//
-// To perform an interaction with a widget in your test, use the WidgetTester
-// utility in the flutter_test package. For example, you can send tap and scroll
-// gestures. You can also use WidgetTester to find child widgets in the widget
-// tree, read text, and verify that the values of widget properties are correct.
-
-import 'package:flutter/material.dart';
-import 'package:flutter_test/flutter_test.dart';
-
-void main() {
-  testWidgets('Counter increments smoke test', (WidgetTester tester) async {
-    // Build our app and trigger a frame.
-    // await tester.pumpWidget(const MyApp());
-
-    // Verify that our counter starts at 0.
-    expect(find.text('0'), findsOneWidget);
-    expect(find.text('1'), findsNothing);
-
-    // Tap the '+' icon and trigger a frame.
-    await tester.tap(find.byIcon(Icons.add));
-    await tester.pump();
-
-    // Verify that our counter has incremented.
-    expect(find.text('0'), findsNothing);
-    expect(find.text('1'), findsOneWidget);
-  });
-}