Why no app can recover a password you already use
Password generator listings collect a steady stream of one-star reviews from people who installed one expecting it to reveal a password they had forgotten, or — more often — someone else's. It does not work that way, and understanding why is genuinely useful, because the apps that claim otherwise are the dangerous ones.
A generator makes; it does not read
A password generator is a dice roll. It produces a new string from a random source and hands it to you. It has no input from any account, any website or any other app. There is nothing in it that could look up an existing password, because it was never given one.
Where your existing passwords actually live
- On the site's server, as a hash. A well-run service never stores the password itself. It stores a one-way hash, deliberately slow to compute, so that even the operator cannot read it back. That is also why a site emails you a reset link instead of your old password — it genuinely does not have it.
- In your browser or password manager, encrypted. Locked to your device and your account, behind a master password or the device's secure hardware. Android does not let one app read another app's stored credentials.
- In your head or on paper. No software involved at all.
An ordinary app on your phone cannot reach any of these. The operating system isolates app storage from other apps by design, and that isolation is the main thing standing between a random download and everything on your device.
What apps claiming to recover passwords are actually doing
- Showing ads and nothing else. The most common and least harmful case: the app is a shell built to farm installs from a promise it never keeps.
- Asking for accessibility or notification access. Those permissions can read screen content. An app that wants them to "recover" a password is asking to watch everything you type.
- Phishing you directly. A form asking for the account and password you want to "recover", which simply sends what you type to someone else.
If an app asks for accessibility service access, notification access, or your login details for another service in order to retrieve a password, close it and uninstall it. No legitimate tool needs any of that.
How to actually get back into an account
- Use the service's own reset. "Forgot password" sends a link to your email or phone. This is the only path that works, and it is the reason your email account deserves your strongest password.
- Check the browser and the system password manager. On Android, Settings → Google → Autofill, or your browser's saved passwords. Both can show a stored password after you authenticate.
- Contact support. They cannot tell you the old password, but they can verify your identity and reset the account.
- Then generate a new one and store it somewhere you control.
The Wi-Fi password question
This one has a real answer: for a network your phone is already connected to, Android can show the saved password in Settings → Network & internet → the network → Share, behind your screen lock. That is your own device showing you your own credential, not an app recovering a secret. For a network you are not on, there is no legitimate way, and apps offering one are offering to attack someone else's router.
Lockmint
Lockmint says this on its very first screen, because the misunderstanding is common enough to be worth addressing before anything else. It creates new passwords — random characters, passphrases and PINs — and it has no internet permission beyond the advertising SDK, no accessibility access, and no way to read anything stored by another app.