How It Works

Four Steps to Hardware-Backed Protection

From install to unlock, everything is designed to be fast, offline, and secure.

Install Yubi AppGate

Download the app from Google Play and open it. No account creation required since the app is fully offline. On first launch you'll see the Setup tab with enrollment and service status.

Enroll Your YubiKey

Your YubiKey must have an HMAC-SHA1 challenge-response secret programmed in Slot 1 or Slot 2 (via YubiKey Manager). Select the matching slot in the app, then tap your key over NFC or connect via USB-C. The app sends a test challenge and records the hardware response. This is a Trust On First Use (TOFU) enrollment. The raw secret is never entered into the app.

Choose Apps to Protect

Switch to the Apps tab to see all installed apps. Toggle the protection switch on any app you want to lock behind your YubiKey. The free version supports up to 2 protected apps; Pro unlocks unlimited protection.

Authenticate & Unlock

When a protected app is opened, whether from a launcher, recent apps, or a deep link, a lock screen appears. Tap your YubiKey over NFC or press the USB button. The app generates a fresh challenge, sends it to the YubiKey, and verifies the response against the enrolled identity. If it matches, the app unlocks instantly. A short cooldown lets you switch back without re-tapping every time.

What You Need

📱

Android Device

Android 7.0 (Nougat) or later. NFC-capable device recommended; USB-C also supported.

🔑

YubiKey

Any YubiKey with HMAC-SHA1 challenge-response support (YubiKey 5 series, YubiKey 5C NFC, etc.).

Optional: Enable System-wide Protection

By default, Yubi AppGate gates apps launched from within the app. For system-wide protection that blocks protected apps no matter how they're launched, enable the app's accessibility service in Settings → Accessibility → Yubi AppGate.

Why an accessibility service? Android does not provide an API for third-party apps to intercept app launches. The accessibility service monitors foreground window changes to detect when a protected app appears, then overlays the lock screen. The service does not read or modify screen content. It only observes package names.

You can also enable uninstall protection via Device Administrator mode, which prevents the app from being removed without first entering your phone's screen lock.

Lock Android Settings: You can add Android Settings itself to your protected app list. This prevents anyone from disabling the accessibility service or removing Device Administrator privileges without first authenticating with your YubiKey. Be aware that if your key is lost or destroyed, there is no way to access Settings to reconfigure the device. A full factory reset would be required to regain control.