Built for Hardware Security

Hardware Security Key Protection

Unlike PIN or pattern-based app lockers, Yubi AppGate relies on a physical hardware security key: your YubiKey. The app uses the HMAC-SHA1 challenge-response protocol, where a random cryptographic challenge is sent to the YubiKey and the key computes a response using a secret stored in its tamper-resistant secure element.

This means authentication cannot be bypassed by guessing, shoulder-surfing, or screen recording. You need the physical key. Period.

Passwordless Authentication

There are no passwords to type, no PINs to remember, and no biometrics to enroll. When a protected app is launched, Yubi AppGate presents a lock screen and waits for your YubiKey. One tap (NFC) or one click (USB) and the challenge-response handshake completes in under a second.

This is true passwordless security: possession of the hardware key is the only factor required.

NFC & USB-C Connection

Yubi AppGate supports both connection methods offered by modern YubiKeys:

• NFC: Hold your YubiKey against the back of your phone. The app uses Android's reader mode to communicate via ISO-DEP (ISO 7816), selecting the OTP applet and executing challenge-response directly.
• USB-C: Plug your YubiKey into the USB-C port. The app communicates over the CCID (smart card) interface, providing the same secure challenge-response without NFC.

Transport status is shown in-app so you always know whether your key is detected and ready.

No Cloud Accounts Required

Yubi AppGate is fully offline. There are no accounts to create, no cloud services involved, and no data leaves your device. Enrollment happens locally: the app sends a challenge to your YubiKey, records the response, and uses that pair for future verification.

Your YubiKey's shared secret is never transmitted over the network. Authentication is verified entirely on-device.

System-wide App Protection

With the accessibility service enabled, Yubi AppGate monitors which app is in the foreground. When a protected app is detected, whether launched from the home screen, recent apps, or another app, the lock screen appears immediately, requiring YubiKey authentication before the app becomes usable.

After a successful unlock, a short cooldown period allows you to switch back without re-authenticating every time.

Uninstall Protection

An optional device administrator mode prevents the app from being silently uninstalled by someone with temporary physical access to your device.