Password Depot for Android — QA Test Report

Build 20.0.0-beta15 (1945) · Round 14 · Generated 9/16/2026, 2:52:44 PM

1 · Environment

Device / Android	Samsung Galaxy S22, Google Pixel 10 Pro, Xiaomi Redmi Note 14 Pro, Samsung Galaxy Tab S11
Keyboard	Samsung Keyboard 5.9.12, Microsoft SwiftKey, Gboard
Browser(s)	Chrome 152, Edge 152, Firefox 155
Build line	20.0.0-beta15 (1945)
Tester	Sheva Ma
Date started	2026-Sep-15

2 · Summary

Block	Total	✅ Pass	❌ Fail	⏭️ Skip
Part 0 — Round 14 Re-Test: Beta13 Bug Fixes	13	11	2	0
Part 0b — Round 14 New Features & Explicit Retests	3	1	0	2
Part 1 — Core Pass: A1–A10 (Every Tester, Every Device)	10	7	3	0
Part 3 — Focus Blocks C1–C11	11	9	0	2
Total	37	28	5	4

Items tested / total	37 / 37
Pass rate (of decided items)	85%
Failures	5
Skipped	4

3 · Failures (5)

R9 AC-487 New database starts with Windows default categories

Section: Part 0 — Round 14 Re-Test: Beta13 Bug Fixes

Tested device: Samsung Galaxy S22

Comments / Jira key: Issue still reproducible, reopened.

R12 AC-458 (One UI 7) Autofill test page follows the app language

Section: Part 0 — Round 14 Re-Test: Beta13 Bug Fixes

Tested device: Samsung Galaxy S22

Comments / Jira key: Issue still reproducible, reopened.

A7 Autofill in Your Daily Browser

Section: Part 1 — Core Pass: A1–A10 (Every Tester, Every Device)

Tested device: Galaxy S22

Comments / Jira key: https://internal.tracker.password-depot.de/browse/AC-493
https://internal.tracker.password-depot.de/browse/AC-494

A9 Appearance, Language, Rotation, Tablet

Section: Part 1 — Core Pass: A1–A10 (Every Tester, Every Device)

Tested device: Galaxy S22

Comments / Jira key: https://internal.tracker.password-depot.de/browse/AC-458

A10 Stability & Error Visibility

Section: Part 1 — Core Pass: A1–A10 (Every Tester, Every Device)

Tested device: Galaxy S22

Comments / Jira key: https://internal.tracker.password-depot.de/browse/AC-524

3b · Skipped (4)

ID	Title	Reason
N1	One-Time Codes from the Server	ES v20 is not ready for testing, hence skip it.
N2	Sign-in Error Messages (Client Part)	ES-987 is not fixed, hence cannot verify this yet.
C9	Enterprise Offline Copy	No ES v20 available for testing.
C11	Hand-Over of Previous-App Offline Changes	No ES v20 available for testing.

4 · Detailed Results

Part 0 — Round 14 Re-Test: Beta13 Bug Fixes

These bugs were reported in Round 13 and claimed fixed. Re-test every one on build 1945.

R1AC-496Sev-0 ✅ PASS

Crash “Placement happened before lookahead” in list/detail layout

What to test: The Sev-0 crash in the list/detail layout was reported in Round 13. The layout no longer uses the pane scaffold that caused it.

Steps

Repeat both step sequences from the original report on a Galaxy S22 with a cloud database.
Open the list, open a detail, navigate back and forth, rotate and switch panes.
Watch for any crash, ANR or freeze.

Expected

No crash “Placement happened before lookahead”.
List/detail layout behaves correctly on phones and tablets.

Result

Status: ✅ PASS

Comments:

— none —

R2AC-505 ✅ PASS

Leaving the server mode no longer signs you out

What to test: A session must end only by signing out, locking from the app bar, auto-lock in the background, a 401 from the server, or opening the offline copy.

Steps

Sign in to Enterprise Server.
Navigate Enterprise → entries, search, settings → Enterprise, then back.
Confirm you are still signed in.

Expected

Leaving the server mode does not sign you out.
The session ends only through the documented actions.

Result

Status: ✅ PASS

Comments:

— none —

R3AC-506 / AC-507 ✅ PASS

WebDAV errors now name the HTTP status

What to test: When the storage location answers with an error, the app now says so with the HTTP status instead of “could not be reached”, and the support data records the status.

Steps

Trigger a WebDAV error (e.g. upload a file larger than nginx client_max_body_size, default 1 MB).
Observe the error message.
Check the support data for the recorded HTTP status.

Expected

Message names the HTTP status, e.g. “The storage location answered with an error (HTTP 413) …”.
Support data records the status.

Result

Status: ✅ PASS

Comments:

— none —

R4AC-515 ✅ PASS

Samsung keyboard “https://” suggestion no longer leaves a space

What to test: The Samsung keyboard’s “https://” suggestion left a space in web addresses. This affected the website, second URL and host/URL fields.

Steps

Open an entry editor with a URL field.
Use the Samsung keyboard’s “https://” suggestion.
Check the resulting value for a stray space.

Expected

No space is inserted after “https://”.

Result

Status: ✅ PASS

Comments:

— none —

R5AC-516 ✅ PASS

Chrome 131+ save dialog appears with the page change

Setup needed: A device with Chrome 131+.

What to test: Chrome 131 or newer in its own autofill mode: the save dialog now appears with the page change after a login.

Steps

Log in on a test page in Chrome 131+ with a credential typed manually.
Watch for the Password Depot save dialog as the page changes.
Check the support data for a SAVE line per request.

Expected

Save dialog appears reliably after the login.
Support data shows a SAVE line per request.

Result

Status: ✅ PASS

Comments:

— none —

R6AC-518 / AC-519 ✅ PASS

Information entries in the server editor use Markdown

What to test: In the server entry editor the Information entry content is a Markdown editor and there is no separate comment field, exactly as in Windows. The detail view renders the content as Markdown.

Steps

Open an Information entry on the server in the editor.
Check that there is a Markdown content editor and no separate comment field.
Save and view the detail; confirm Markdown rendering.

Expected

Markdown content editor, no separate comment field.
Detail view renders Markdown.

Result

Status: ✅ PASS

Comments:

— none —

R7AC-520 ✅ PASS

Credit-card expiry 05/2026 stays 05/2026

What to test: A credit-card expiry typed as 05/2026 was stored as 05/0262. This is fixed.

Steps

Create or edit a credit card entry with expiry 05/2026.
Save, reopen, and check the stored value.

Expected

Value is stored and displayed as 05/2026.
No digit shift (05/0262).

Result

Status: ✅ PASS

Comments:

— none —

R8AC-521 ✅ PASS

PuTTY entries show “Key password”

What to test: PuTTY entries previously showed an internal tag instead of “Key password”.

Steps

Create or open a PuTTY entry.
Check the label of the key password field.

Expected

Label reads “Key password”.

Result

Status: ✅ PASS

Comments:

— none —

R9AC-487 ❌ FAIL

New database starts with Windows default categories

What to test: A new database starts with the Windows default categories (General, Windows, Private, Internet, Home Banking, in the app language) so the category picker is never empty.

Steps

Create a new database.
Open an entry editor and open the category picker.

Expected

Default categories are present in the app language.
Category picker is never empty.

Result

Status: ❌ FAIL

Tested device: Samsung Galaxy S22

Comments:

Issue still reproducible, reopened.

R10AC-483 ✅ PASS

Start screen offers last server database when no local database exists

What to test: The start screen now offers your last server database as the main action when no local database exists. It previously said “no database yet”.

Steps

Remove all local databases from the app (or use a fresh install).
Open the app; observe the start screen.

Expected

The last server database is offered as the main action.
No misleading “no database yet” message.

Result

Status: ✅ PASS

Comments:

— none —

R11AC-495 ✅ PASS

“New file replaces this database” notice disappears after unlocking

What to test: After unlocking, the notice that the new file replaces this database once you unlock no longer remains visible.

Steps

Open a database over an existing one (staged replacement).
Unlock successfully.
Check that the notice is gone.

Expected

Notice disappears after unlocking.

Result

Status: ✅ PASS

Comments:

— none —

R12AC-458Sev-3 ❌ FAIL

(One UI 7) Autofill test page follows the app language

Setup needed: Samsung device with One UI 7.

What to test: On One UI 7 the Autofill test page now follows the app language and no longer flips the app into the system language.

Steps

Set a non-system app language.
Open Settings → Autofill test.
Check the page language and the app language after leaving.

Expected

Autofill test page follows the app language.
App language is not flipped to the system language.

Result

Status: ❌ FAIL

Tested device: Samsung Galaxy S22

Comments:

Issue still reproducible, reopened.

R13AC-475Sev-3 ✅ PASS

Clipboard “Clear now” on Samsung — no app defect

What to test: The clipboard “Clear now” action sits in the app’s notification in the notification panel (pull it down fully). The keyboard’s clipboard and Samsung’s clipboard overlay are separate system features.

Design: true

Steps

Copy a password on a Samsung device.
Pull down the full notification panel.
Find the Password Depot notification and use “Clear now”.

Expected

The “Clear now” action is available in the notification.
Keyboard clipboard and Samsung overlay are outside the app — do not report as a bug.

Result

Status: ✅ PASS

Comments:

— none —

Part 0b — Round 14 New Features & Explicit Retests

New in this build or explicitly requested for retest. Verify each feature works as described.

N1AC-485 / ES-986 ⏭️ SKIP

One-Time Codes from the Server

Setup needed: Password Depot Enterprise Server 20.0.0 with ES-986 (a dev build today, not released). Against any older server nothing changes.

What to test: For a server entry with a one-time code, the detail view shows a “One-time code (TOTP)” line, and autofill fills the code from the live server session. The seed stays on the server and every read appears in the server’s audit trail.

Steps

Sign in to Enterprise Server 20 with ES-986.
Open a server entry with a one-time code; check the detail view for a “One-time code (TOTP)” line.
Trigger autofill on a matching login page and check that the code is filled from the live server session.
Check the server’s audit trail for the read.

Expected

Detail view shows “One-time code (TOTP)”.
Autofill fills the current code from the server.
Every read appears in the server’s audit trail.
Against an older server, behaviour is unchanged.

Result

Status: ⏭️ SKIP

Comments:

ES v20 is not ready for testing, hence skip it.

N2AC-497 / ES-987 ⏭️ SKIP

Sign-in Error Messages (Client Part)

What to test: The app distinguishes “the server could not send the authentication e-mail” from “no e-mail address is stored for this account” in both sign-in steps.

Known issue / note: ⚠️ Until server ticket ES-987 is resolved, the server still reports “user name or password is wrong” for both cases. The app distinction is prepared but may not be visible yet.

Steps

Attempt sign-in with an account with no e-mail stored.
Attempt sign-in triggering a mail delivery failure (if the server supports ES-987).

Expected

Distinct error messages for each case (once the server sends the new codes).
Both sign-in steps report the correct message.

Result

Status: ⏭️ SKIP

Comments:

ES-987 is not fixed, hence cannot verify this yet.

N3AC-457 ✅ PASS

Dropbox — End-to-End Retest

What to test: The sign-in now reaches the real Dropbox login page in Chrome (“Log in or sign up to Dropbox to link with Password Depot”). Dropbox accepts the app’s redirect address.

Steps

Connect a database on Dropbox via “Open from cloud…” or “Create new database”.
Complete the sign-in in Chrome.
Edit the database on Android and on Windows; sync.
Disconnect the Dropbox storage location.

Expected

Sign-in completes without “Cloud sign-in failed”.
Edits on Android and Windows merge without data loss.
Disconnect works cleanly.
If “Cloud sign-in failed” still appears after logging in, attach the support data (it records the reason).

Result

Status: ✅ PASS

Comments:

— none —

Part 1 — Core Pass: A1–A10 (Every Tester, Every Device)

Estimated time: 45–60 minutes. Run on every device you test.

A1 ✅ PASS

First Launch & Database Creation

Steps

Fresh install (or update): open the app.
Create a database with a name and a test master password.
Confirm the empty entry list is shown.
Relaunch the app.
Enter the master password; confirm unlock.
Enter a wrong master password.

Expected

Empty list shown after creation.
After relaunch, app is locked.
Correct password unlocks; wrong password gives a clear error message.

Result

Status: ✅ PASS

Comments:

— none —

A2 ✅ PASS

Entries of Several Types

Steps

Create the following entries: password entry (with URL of a test account), credit card (PIN/CVV), identity entry, information entry, entry with a protected custom field.
While typing secret fields (password, PIN, CVV, protected values), verify keyboard behavior.
Open detail view for each entry.
Edit each entry and re-save.

Expected

Secret fields use a password keyboard: no word suggestions, no swipe input; keyboard must not “learn” the value.
Detail view shows values readable (matching Windows).
Nothing lost after edit and save.

Result

Status: ✅ PASS

Comments:

— none —

A3 ✅ PASS

Folders, Search, Trash

Steps

Create two folders.
Move entries between them.
Search by title, username, and URL.
Delete an entry (move to trash).
Restore it from the recycle bin.

Expected

All operations complete without errors.
Restored entry appears back in its original location.

Result

Status: ✅ PASS

Comments:

— none —

A4 ✅ PASS

Locking

Steps

Background the app and return quickly (within the auto-lock time).
Stay away past the auto-lock time (Settings → Security → Auto-lock).
Force-close the app from Recents.
Relaunch.

Expected

Quick background: app stays open.
After timeout: app is locked.
After force-close: next start is always locked.

Result

Status: ✅ PASS

Comments:

— none —

A5 ✅ PASS

Biometric Unlock + Invalidation

Steps

Enable Settings → Security → Biometric unlock.
Lock the database.
Unlock using fingerprint/face.
Go to Android system settings and enroll an additional fingerprint.
Return to the app.

Expected

Biometric unlock works in step 3.
After enrolling new fingerprint: app refuses biometrics with an explanation (“biometrics were reset…”), requires master password, database remains fully intact.
Can re-enable biometric unlock afterwards.

Result

Status: ✅ PASS

Comments:

— none —

A6 ✅ PASS

Clipboard

Steps

Copy a password from the detail view.
Check if a countdown notification appears (Android 13+: grant notification permission if asked).
Paste the password in another app — confirm it works.
Wait 30 seconds; attempt to paste again.
Try the “Clear now” button in the notification.
Check the keyboard’s own clipboard history (Samsung/Gboard/SwiftKey).

Expected

Countdown notification appears immediately.
Password can be pasted within 30 seconds.
After 30 seconds: password can no longer be pasted (usernames/URLs: 60 s).
“Clear now” clears immediately.
Note: keyboard clipboard history (outside the app’s control) may still show the value — document this, do NOT report as a bug.

Result

Status: ✅ PASS

Comments:

— none —

A7 ❌ FAIL

Autofill in Your Daily Browser

Note: ⚠️ Chrome 131+ extra step required: Chrome → Settings → Autofill services → “Autofill using another service” → restart Chrome. Older Chrome reaches Password Depot only in an unreliable compatibility mode — please update Chrome.

Steps

Enable Settings → Autofill service (follow system dialogs).
Open Settings → Autofill test; confirm the suggestion appears on the built-in test form.
Navigate to a test account login page in your browser.
Verify autofill suggestion appears (inline chip or system sheet).
Fill with Password Depot; confirm fields are filled correctly.
Log in with a new credential typed manually; confirm save/update prompt appears.
Negative check: navigate to a different or look-alike domain; confirm the entry is NOT offered under “Matching this site”.

Expected

Suggestion appears on matching domain.
Save/update flow works.
No suggestion offered for non-matching domains.

Result

Status: ❌ FAIL

Tested device: Galaxy S22

Comments:

https://internal.tracker.password-depot.de/browse/AC-493
https://internal.tracker.password-depot.de/browse/AC-494

A8 ✅ PASS

Autofill in One App

Steps

Open any app with a login screen (use a test account).
Trigger autofill.
Test an app using Android Credential Manager (e.g. Facebook) if available.

Expected

Autofill works or cleanly offers nothing — no crash, no wrong entry offered.
Credential Manager apps: system sheet offers the matching entry when Digital Asset Links are published; otherwise “No entry for …” message (no crash).

Result

Status: ✅ PASS

Comments:

— none —

A9 ❌ FAIL

Appearance, Language, Rotation, Tablet

Steps

Switch appearance: dark → light → system mode.
Switch app language DE ↔ EN (Settings → App language on Android 13+).
Rotate the device while unlocked; confirm session and selection survive.
(Tablet/foldable only) Verify the two-pane list+detail layout.
Note any clipped, untranslated, or oddly-worded text.

Expected

All appearance/language switches work without restart.
Rotation preserves state.
Two-pane layout is correct on tablets.

Result

Status: ❌ FAIL

Tested device: Galaxy S22

Comments:

https://internal.tracker.password-depot.de/browse/AC-458

A10 ❌ FAIL

Stability & Error Visibility

What to test: What to watch for throughout testing: any crash or ANR (app not responding); any freeze that requires a force-close; any error that is swallowed silently (action appears to work but data is wrong).

Steps

If any of the above occur, open Support data immediately (lock → “Support data…” on unlock screen).
Copy the version line and any listed events.
File a Jira Bug with Sev-0 and attach the support data.

Expected

No crashes, freezes, or silently swallowed errors.

Result

Status: ❌ FAIL

Tested device: Galaxy S22

Comments:

https://internal.tracker.password-depot.de/browse/AC-524

Part 3 — Focus Blocks C1–C11

Complete the blocks assigned to you, or any you have the setup for.

C1 ✅ PASS

TOTP

Setup needed: A test account with 2FA / TOTP setup, and a reference authenticator app.

Steps

Add a TOTP secret to a test entry using the entry editor.
Use “Scan QR code” (camera or photo) to add the TOTP secret — test the QR scanner.
Compare the 6-digit code with a reference authenticator for at least 3 consecutive periods.
With autofill: open the 2FA field on a login page; confirm the code is offered only into the one-time-code field.
Confirm the code is never offered into user/password fields.

Expected

Codes match the reference authenticator for ≥3 periods.
Code offered only into OTP fields.
QR scanner works with camera and photo; invalid QR code rejected with message.

Result

Status: ✅ PASS

Comments:

— none —

C2 ✅ PASS

Passkeys (Android 14+)

Setup needed: Android 14+, device screen lock enabled. Test site: https://webauthn.io

Steps

Settings → Passkey provider → select Password Depot. Verify the row shows “Enabled”.
On webauthn.io: register a new passkey (should land in the Password Depot database).
Sign in with the passkey using the same database.
Move the passkey entry to the trash.
Attempt sign-in again → expect “No matching passkey in the database”.
Restore the passkey entry.
Attempt sign-in again → confirm it works.

Expected

All steps above behave as described.
If sign-in fails at any point, attach the support bundle.

Result

Status: ✅ PASS

Comments:

— none —

C3 ✅ PASS

WebDAV Sync

Setup needed: A real Nextcloud and/or Apache WebDAV server over HTTPS.

Steps

Link the WebDAV server (Settings → Storage location & sync).
Perform the initial database upload.
Edit an entry on Android; sync; verify on Windows.
Edit the same entry on both Android and Windows simultaneously.
Sync from Android.

Expected

Initial upload succeeds.
Single-side edits merge without data loss.
Concurrent edit on same entry: a conflicted copy appears on Android; original is untouched; conflict can be marked as resolved; nothing lost silently.
Note the server product + version and whether the account reports safe concurrent writes.

Result

Status: ✅ PASS

Comments:

— none —

C4 ✅ PASS

Windows Interop

Setup needed: Windows Password Depot 19 and the same database accessible on both (file copy or WebDAV).

Steps

Open the same .pswe file alternately in Windows PD 19 and Android.
Verify that the following survive both directions (Android→Windows, Windows→Android): entries with umlauts/emoji in titles, folders and sub-folders, attachments, TAN lists (kept in file even though Android does not display them), entry history, custom icons, second-password (“four eyes”) entry.
Specifically: set an expiry date on Android; open in Windows; confirm the date is preserved.
Edit the same entry on both sides; sync; confirm a conflict copy appears rather than a silent overwrite.

Expected

All content survives both directions unchanged.
Any Windows-visible difference is a top priority report.

Result

Status: ✅ PASS

Comments:

— none —

C5 ✅ PASS

Attachments

Steps

Attach a photo (a few MB) to an entry; reopen and export it; verify the file is intact.
Attach a PDF (a few MB) to an entry; reopen and export it; verify the file is intact.
Attempt to attach a file over 25 MB.

Expected

Photo and PDF attach, export, and open correctly.
File over 25 MB: refused with a clear message, no crash.

Result

Status: ✅ PASS

Comments:

— none —

C6 ✅ PASS

Multi-Database & Master Password Change

What to test: Clarification (tester question of 15 Sep): the app’s copy of every database lives in the app’s private storage, invisible to file managers by design. “The file must survive” refers to a database at a storage location (a file opened via “Open database file…”, WebDAV or cloud); a database created “on this device” has no external file — removing it deletes the only copy, and the app says so and offers “Export a copy first”.

Steps

Create a second database; switch between both databases.
Export a copy of the second database (Settings → Databases & sync → “Export a copy…”, save to Downloads).
Open that file via “Open database file…” (it appears as “Connected to a storage location”).
Remove THAT entry from the app — the file in Downloads must still exist — and open it again.
A database created “on this device”: removing it deletes the only copy; the app must say so and offer “Export a copy first”.
Note: after “remove from app” the backup copies the app kept for that database are gone too — use a database you do not need for C7.
Change the master password of a test database.
Attempt to unlock with the old password.
Check biometric unlock status.

Expected

Switching between databases works seamlessly.
“Remove from app” does not delete the external file.
Old password is rejected after change.
Biometric unlock requires re-enabling after a password change.

Result

Status: ✅ PASS

Comments:

— none —

C7 ✅ PASS

Backup & Restore

Steps

Navigate to Databases & sync → Backup copies; create a backup of a test database.
Make a few changes to the database.
Restore an earlier backup copy.
Enter a wrong password during restore; check for throttle (3 s / 10 s delay) and message.
Enter the correct password; confirm restore.
Verify the restored state is complete; confirm the previous state was saved as a new backup copy first; confirm the chosen copy is still listed.
(If database is linked to a storage source) Confirm a notice says the next sync will merge instead of replace.
Attempt to restore a deliberately corrupted backup file.

Expected

Correct password restores successfully; current state saved before restore; chosen backup still listed.
Wrong password: throttle + clear message.
If linked to storage: merge notice shown.
Corrupted backup: refused with error; active database untouched.

Result

Status: ✅ PASS

Comments:

— none —

C8 ✅ PASS

Enterprise Thin Client

Setup needed: Office test server (Enterprise Server 20).

Steps

Open the app → “Enterprise server…” on the start screen.
Enter the server address and port; log in.
On first connect: verify the TLS fingerprint confirmation dialog appears. Compare the SHA-256 with the server certificate (Windows: Home → PD Enterprise Server → “View server certificate”).
Confirm server and port are remembered after the first successful login.
Browse and search entries on the server.
Edit an entry and save.
Test sign-in with Windows domain credentials (DOMAIN\user or user@company.com) if AD is available.

Expected

TLS fingerprint dialog appears on first connect.
Login succeeds; server/port remembered.
Browse, search, and edit work.

Result

Status: ✅ PASS

Comments:

— none —

C9 ⏭️ SKIP

Enterprise Offline Copy

Setup needed: Enterprise Server 20, TCP port 25020, a database with the offline right granted.

Steps

Sign in to the server; tap “Save offline copy…” on the database list.
Enter the server password (2FA accounts get a code field in step 2).
Tap “Load databases” — confirm the TLS fingerprint once.
Pick a database; confirm the copy is saved.
Sign out; tap “Open offline copy” on the login screen; open with the server password.
Verify the status line reads “Enterprise Server · offline copy”.
Create/edit an entry offline; note the waiting-changes counter in the status line.
Settings → Sync… → “Send changes to the server”: certificate question appears inside this screen; enter fingerprint; confirm all changes sent; “Load fresh copy” offered.
Check: entry the server marks as non-editable → no edit action shown.
Check: without export/save-as rights → Export and “Save as” are absent.
Check: “Usable until” date matches the server’s offline period.
Check: offline copy cannot be linked to cloud/WebDAV storage.
Enter a wrong server password for an existing copy; confirm the error names the password (not “changes waiting”).

Expected

All steps above behave as described.
Report the server version from its console with any failure.

Result

Status: ⏭️ SKIP

Comments:

No ES v20 available for testing.

C10 ✅ PASS

Enterprise Single Sign-On (OpenID Connect / Entra ID)

Setup needed: Enterprise Server 20 with a configured OpenID Connect or Entra ID sign-in provider; the provider registration must contain the redirect oidc.acebit://password-depot.de/.

Steps

Choose “Single sign-on (OpenID Connect / Entra ID)” in the Enterprise login; tap “Connect”.
Complete sign-in in the browser; confirm the app returns to the database list.
Sign out; use “Sign in with a different account”; confirm the provider prompts for account selection.
Start a sign-in and cancel it in the browser; confirm the app shows “The sign-in in the browser was cancelled”.
Sign in with an account the server does not know; expect “The Enterprise Server did not accept the sign-in…”.
Rotate the device while the browser is open; confirm the sign-in continues.
Press Home during sign-in and return via the browser.
(If configured) Test the second factor after sign-in.

Expected

All scenarios above behave as described.
Report: provider type (Entra ID or other), server version (19 or 20), and exact error messages.

Result

Status: ✅ PASS

Comments:

— none —

C11 ⏭️ SKIP

Hand-Over of Previous-App Offline Changes

Setup needed: Enterprise Server 20, TCP port 25020. Either a previous-app installation with unsent offline changes, or the prepared file from the dev team.

Steps

Start with the previous Password Depot for Android app installed and an Enterprise database with unsent offline changes.
Update to this build; open “Import from previous app”; take the database over.
Verify the report names the number of unsent changes and says they can be sent from the database.
“Unlock now”: confirm the note at the top shows the same number.
Tap “Send to the server…”: port 25020 and database name pre-filled; enter server, account, password.
On first contact: certificate fingerprint question appears inside the dialog — enter it.
Confirm the note disappears and the changes are on the server (verify in the Windows client).
Test with a rejected change (e.g. no delete permission): note stays and names the reason; a later send tries only remaining open changes.
Confirm the database never silently loses the note.

Expected

All steps above behave as described.

Result

Status: ⏭️ SKIP

Comments:

No ES v20 available for testing.

5 · Device Matrix Contribution

Dimension	Variant	Covered	Notes
Keyboard	Gboard	✅
Keyboard	Samsung Keyboard	✅
Keyboard	SwiftKey	✅
Browser	Chrome	✅
Browser	Edge	❌	https://internal.tracker.password-depot.de/browse/AC-493
Browser	Firefox	✅
Browser	Samsung Internet	❌	https://internal.tracker.password-depot.de/browse/AC-494
Autofill style	Android 11+ inline chips (note which you saw)	—
Autofill style	Android ≤13 dropdown	✅
Clipboard	Samsung clipboard behavior	✅
Clipboard	Pixel clipboard behavior	✅
Clipboard	Xiaomi clipboard behavior	✅
Biometrics	Fingerprint	✅
Biometrics	Face unlock	✅
Biometrics	Both enrolled	n/a	No real device for testing.
OEM quirks	Xiaomi/HyperOS battery saver — auto-lock reliable?	n/a	No real device for testing.
OEM quirks	Samsung battery saver — session killed mid-edit?	✅
Form factor	Phone	✅
Form factor	Tablet (≥ 600 dp)	✅
Form factor	Foldable	n/a	No device

6 · Reporting Reference

Jira Project	Android Client (AC)
Issue Type (bugs)	Bug
Issue Type (coverage)	Task
Affects Version	20.0.0
Build line	`20.0.0-beta15 (1945)`
Severity 0	crash · data loss · lock-out
Severity 1	feature wrong or unusable
Severity 2	wrong, has a workaround
Severity 3	visual / text
Deadline	within 10 working days
Bug summary format	`<area>: <short title>`
Coverage summary format	`Beta coverage: <device>`

Support data: lock the app → tap “Support data…” on the unlock screen. Strictly local, secret-free. Copy version line + events into the issue.