Legal
Open Source Licenses
PassKub is built on top of many open source libraries. This page lists every significant third-party dependency across our apps and services — what it's used for and under what license — grouped by component.
No component in PassKub uses copyleft-licensed software (GPL/AGPL/LGPL) — every dependency below is permissively licensed (MIT, BSD, or Apache-2.0). License identifiers are believed accurate based on each package's public registry listing at the time of writing; see each package's own repository for the authoritative license text.
Mobile app (Android, iOS, Windows, macOS) — Flutter/Dart
| Package | License | Used for |
|---|---|---|
| Flutter & Dart SDK | BSD-3-Clause | App framework and language runtime |
| flutter_riverpod | MIT | App-wide state management |
| flutter_slidable | MIT | Swipe-to-edit/delete vault entry tiles |
| cryptography | Apache-2.0 | Argon2id key derivation + AES-256-GCM vault encryption |
| flutter_secure_storage | BSD-3-Clause | Keychain/Keystore-backed secure local storage |
| path_provider | BSD-3-Clause | Local vault file location |
| local_auth | BSD-3-Clause | Biometric (fingerprint/Face ID) unlock |
| permission_handler | MIT | Camera/NFC runtime permission requests |
| qr_flutter | MIT | QR code generation (Quick Fill, device pairing) |
| mobile_scanner | Apache-2.0 | QR code scanning on Android/iOS/macOS |
| camera / camera_windows | BSD-3-Clause | Still-photo capture (Windows QR scan fallback) |
| zxing2 | Apache-2.0 | Pure-Dart QR decoding (Windows scan path) |
| image | MIT | JPEG decoding for the Windows QR scan path |
| nfc_manager / nfc_manager_ndef / ndef_record | MIT | NFC tap-to-transfer device handoff |
| nearby_connections | BSD-2-Clause | Offline Bluetooth/Wi-Fi Direct proximity transport (Android) |
| flutter_local_notifications / timezone | BSD-3-Clause | Expiry reminders and local scheduled notifications |
| windows_notification | MIT | Native Windows toast notifications |
| sensors_plus | BSD-3-Clause | Gyroscope-based gimmick unlock gesture |
| flutter_wear_os_connectivity | BSD-3-Clause | Data-layer bridge to the companion wearOS app |
| http | BSD-3-Clause | Sync and billing network requests |
| in_app_purchase | BSD-3-Clause | Google Play Billing / Apple StoreKit purchases |
| flutter_web_auth_2 | MIT | OIDC/SAML organization sign-in browser redirect capture |
| url_launcher | BSD-3-Clause | Opening Stripe Checkout in the system browser (desktop) |
| google_fonts | BSD-3-Clause | Loads the Google Sans font family at runtime |
| uuid | MIT | Local ID generation |
| intl / package_info_plus | BSD-3-Clause | Localization formatting and app version display |
| in_app_review | MIT | Post-trial "rate PassKub" prompt |
| in_app_update | MIT | Android in-app update flow |
| flutter_svg | MIT | Shared line-icon rendering |
| window_manager | MIT | Windows window show/hide/focus for Quick Fill |
| hotkey_manager | MIT | Global keyboard shortcut registration (Windows) |
| win32 / ffi | BSD-3-Clause | Low-level Windows API bindings (foreground window, input simulation) |
| desktop_multi_window | MIT (vendored, locally patched) | Separate native OS window for the Quick Fill popup |
| launch_at_startup | MIT | Launch at login (Windows Registry Run key) |
| tray_manager | MIT | System tray icon (Windows) |
| firebase_core / firebase_messaging | BSD-3-Clause | Push notification wake-up for cross-device sync |
wearOS companion app
| Package | License | Used for |
|---|---|---|
| Flutter & Dart SDK | BSD-3-Clause | App framework and language runtime |
| flutter_wear_os_connectivity | BSD-3-Clause | Data-layer bridge to the phone app |
| sensors_plus | BSD-3-Clause | Gesture-based Quick Fill approval on the watch |
Browser extension (Chrome, Edge, Firefox, Safari)
| Package | License | Used for |
|---|---|---|
| @noble/curves | MIT | Audited elliptic-curve cryptography (X25519 key exchange) |
| hash-wasm | MIT | WebAssembly Argon2id password/vault key derivation |
| jsqr | Apache-2.0 | QR code decoding (device pairing) |
| qrcode | MIT | QR code generation |
| react / react-dom | MIT | Popup and options-page UI |
| typescript | Apache-2.0 | Compiler for the extension's source code |
| vite / @vitejs/plugin-react / @crxjs/vite-plugin | MIT | Build tooling for the Manifest V3 extension bundle |
The extension's native messaging host (for optional OS credential detection) is hand-written Node.js with no third-party dependencies.
Backend (Cloudflare Worker)
| Package | License | Used for |
|---|---|---|
| stripe | MIT | Subscription billing (browser extension Premium) |
| wrangler | MIT | Build and deployment CLI |
| typescript | Apache-2.0 | Compiler for the Worker's source code |
Supabase (hosted authentication + encrypted-vault-sync database) and Cloudflare (Worker hosting) are used as services, not embedded libraries — see our Privacy Policy for the full list of subprocessors.
Windows native components
The Windows Hello credential provider is written directly against the
Windows SDK (COM, CNG/bcrypt.dll, DPAPI, WinHTTP) with zero
third-party libraries. The installer, updater, and uninstaller are plain
.NET applications using only the .NET Base Class Library and Win32
interop — no bundled third-party packages.
Fonts
| Font | License | Used for |
|---|---|---|
| Google Sans / Google Sans Text | Served via Google Fonts (Google LLC), typically distributed under the SIL Open Font License 1.1 | Primary UI typeface across the website, apps, and extension |