LockBox for Android

Install the APK

1. Choose the universal APK if you do not know the device architecture; otherwise use the smaller matching ABI package.
2. Open the downloaded APK from the browser or Downloads application.
3. If Android blocks it, allow “Install unknown apps” only for the browser or file manager you used.
4. Return to the installer and confirm installation.
5. After installation, revoke the unknown-app permission if you do not normally sideload applications.

An update must be signed by the same LockBox release key as the installed version. Android refuses a differently signed APK instead of silently replacing the application.

First start and notifications

On Android 13+, allow notifications so progress, completion and Cancel remain visible while LockBox is in the background. If notification permission is denied, Android still displays foreground-service activity in system controls, but the normal progress notification can be hidden. Choose the interface language on the welcome screen; all Android screens and service messages use it.

Storage Access Framework folders

LockBox uses Android’s system document picker. You grant access only to the files and folders selected there; the app does not request unrestricted storage access.

• For Source, select the folder whose contents will be encrypted.
• For Output, select a separate folder with enough free space.
• For split containers, select the base .lbx and every numbered part when opening.
• Cloud providers may need to download documents locally before LockBox can read them.
• A provider that does not retain document permissions is suitable for an immediate operation, but not a reliable scheduled job.

Choose the destination folder with Browse and enter the container filename separately. The destination must be outside the source folder, including its subfolders. Reusing an output name can replace an older backup; use distinct names to retain versions. Folder access belongs to the selected document provider. After moving folders, revoking access or changing devices, select the folders again before creating a new task.

Create a container

1. Tap Create container and select source and output folders in the Android picker.
2. Enter and confirm a master password, then choose the layer count.
3. Configure compression, padding, split size, optional destruction password and source deletion.
4. Save every generated layer key before leaving the key screen.
5. Review the summary and start. A persistent notification shows progress.

Edition limits match the desktop app: Free allows up to 1 layer with basic 128-bit profiles; Pro allows up to 3 layers, all algorithms, compression and splitting; Max allows up to 20 layers and also unlocks padding, browser, scheduler and the destruction password.

LockBox first stages source documents in its private cache, creates and authenticates the container there, then copies the completed output through the document provider. Existing output is replaced only after a complete staged copy exists.

Master passwords and layer keys accept 1–512 printable ASCII characters: Latin letters, digits and punctuation, without spaces or line breaks. On each layer, choose the algorithm, use Generate key or enter your own key, and use Copy key to save it. Generate key replaces the displayed value; it cannot recover a lost key. Back and Next move between settings; check the final summary and save the final keys before starting.

Open, extract and browse

1. Tap Open container or open a .lbx file from another Android application.
2. Select all split parts, choose an output folder and enter the master password.
3. After authenticated metadata is read, enter every layer key in the displayed order.
4. Use Open for full extraction. Max edition can use Browser for a verified tree and selective extraction.

Browser sessions are held in private cache. Android may reclaim cache when storage is low; if that happens, open the container again before extracting selected entries.

The Android browser shows up to 100 entries per page. Check files or folders, use Back and Next to move between pages, and review the selection counter; selections persist across pages. Extract selected includes the contents of selected folders, while Extract all needs no selection. Choose a destination in the system picker when requested. Browsing and extraction do not edit the original container.

Switching apps, closing the screen and the × button

Once an operation has started, encryption, extraction, metadata reading and browser preparation run in a foreground service rather than in the Activity. A partial wake lock keeps CPU work active while the display is off. Switching apps, returning to the home screen, removing the LockBox task or tapping × closes only the interface; the operation continues and can be reopened from its notification or Operations screen.

Use Cancel in the progress notification when you really intend to stop. Android can still kill a process under exceptional resource pressure; queued state is encrypted and recovered when the service is allowed to start again.

Open Operations and tap an entry to see its stage, progress and error message. Cancel is available for queued and running entries; it stops that operation, not future scheduled runs. When metadata reading completes, Next opens the layer-key screen. When browser preparation completes, open the browser from the operation result. Wait for Completed before treating the output as a successful backup or restore.

Scheduled encrypted backups

The scheduler is available only in Max edition.

1. Open Scheduler and grant Alarms & reminders when Android 12 or newer requests it.
2. Create a task with source/output folders whose access remains valid after the picker closes.
3. Choose a future start time and frequency. LockBox stores the task encrypted with Android Keystore.
4. Do not move, rename or revoke the selected provider folders.
5. Review the next run, success, failure and skipped-run state inside Scheduler.
6. Export tasks only to a password-protected .lbxjobs package and keep that password separately.

Without exact-alarm access, a task remains persisted but cannot be launched reliably from the background. Reopen Scheduler after granting the permission so pending alarms are registered.

Remove task stops future runs; cancel an already queued or running operation separately in Operations. Save as asks for a package password and confirmation; Import requires that same password and adds tasks, so repeated imports can create duplicates. Android task packages are not interchangeable with Windows/CLI packages despite sharing the .lbxjobs extension. Imports still require valid access to the original provider folders; if that access cannot be restored, recreate the tasks with newly selected folders.

Reboot, process restart and interrupted operations

LockBox receives the Android boot-completed and package-replaced events, re-registers enabled alarms and resumes queued work. If Android stopped a running foreground service, the operation is changed back to queued rather than marked successful. Completed, failed and cancelled history no longer retains master passwords or layer keys.

Force stop, battery savers and vendor firmware

Android’s Settings → Apps → LockBox → Force stop is different from swiping away the task. Force stop is an explicit operating-system security action: it disables the app’s services, receivers and alarms until the user opens LockBox again. No application daemon can legally bypass it.

Some manufacturers add aggressive battery restrictions. If scheduled runs are late, set LockBox battery use to Unrestricted, allow background activity and exclude it from vendor “sleeping apps” lists. These vendor settings are not requested automatically because their names differ by device.

Offline activation

1. Open Activation and copy the Android device ID.
2. Obtain a signed Pro or Max key issued for that exact ID.
3. Paste the key and tap Activate. Verification occurs locally without an activation website.

License data is private to the application. Clearing app data, uninstalling, changing Android’s device identity or installing a build with a different application identity can require activation again.

Free space, cache and split containers

• Creation needs private-cache space for staged source data and output-provider space for the final container.
• Extraction needs cache space for the container and decrypted archive plus destination-provider space for files.
• Compression may save space, but already-compressed photos and videos can remain the same size.
• Padding deliberately increases size.
• All split parts are required and should remain in one provider folder.
• Do not use Clear storage while an operation or browser session is active.

Android security model

Update or uninstall

Install a newer APK over the existing app to preserve data, provided it has the same application ID and release signature. Before a major update, export scheduled tasks and keep their exchange password. Uninstalling removes private licenses, task state, operation history and cache, but Android does not delete .lbx containers stored in user-selected external providers.

Android troubleshooting

Plan and validate automatic backups

Start with a small test folder, then verify extraction and file contents before scheduling real data. Export live databases with their own backup tools first. Keep several dated versions on separate storage and preserve all split parts. Delete old backups only after a newer copy has been restored successfully. Source-deletion options are deliberately absent from the routine backup recipes.