VaultApprover

VaultApprover approves Bitwarden "Log in with device" requests on bitwarden.com, bitwarden.eu or your own self-hosted Vaultwarden/Bitwarden server. It does one thing: shows who is signing in, so you can approve or deny it in one tap. KEY FEATURES: • Cloud or self-hosted — bitwarden.com (US), bitwarden.eu (EU) or any server URL • Client certificates (mTLS) — import a .p12/.pfx for a server that requires one • Biometric unlock — Face ID / Touch ID or fingerprint on every launch • Real-time requests — WebSocket updates with a polling fallback • Fingerprint phrase — the same 5-word phrase the official Bitwarden apps show • 5-minute countdown — an expired request can no longer be approved • Request history — every approval and denial with device, IP and response time • Two-step login — authenticator app, email code, YubiKey OTP or recovery code • PIN tab — offline tools for your own PINs: PIN Shift with named, encrypted vectors, PIN 24 (compatible with Ledger Passwords) and YubiKey PIN/PUK • Optional settings sync — sign in with Apple or Google to keep theme, language and timers the same on all your devices; delete the sync account anytime in Settings • English, Russian, Arabic and Simplified Chinese; light and dark themes HOW IT WORKS: 1. Pick bitwarden.com or bitwarden.eu, or enter your server URL 2. Sign in with your email and master password (used once, never stored) 3. Turn on biometric unlock 4. When you choose "Log in with device" on another device, the request shows up in the app 5. Check the fingerprint phrase and tap Approve — done SECURITY: • Your master password is never stored on the device • End-to-end encryption: RSA-2048-OAEP key exchange • Your user key is kept in the device's secure storage behind biometric lock • All cryptography runs on the device — the server never sees your keys • Argon2id and PBKDF2 key derivation • Privacy screen hides the app in the app switcher VaultApprover never shows your vault items. By default it doesn't read them either: only the experimental PIN Shift option (off by default) reads items that have a "PIN Shift" field, and only on the device. Works with accounts that unlock with a master password. SSO, trusted-device and Key Connector accounts are not supported.