com.android.providers.contactkeys Copy

This is the Contact Keys storage provider (ContactsKeysProvider), part of the Android Open Source Project. It is the on-device store behind Android's end-to-end-encryption (E2EE) contact key feature: it holds the cryptographic public keys that a user and their contacts use, so messaging apps can store, retrieve and verify each other's keys through a single system-level API. The user-facing side of this is the "Android System Key Verifier", which provides the verification flows (for example comparing numbers or scanning a QR code) and is delivered through Google System/Play Services rather than by this provider itself. This is a recent, version-specific addition. The platform E2EE contact keys API (E2eeContactKeysManager) was introduced with Android 15, so this provider appears on newer devices; it is not present on older Android releases. As the content provider behind that API, it is used only when an app that uses the platform E2EE key API reads or stores keys through it. For Android Enterprise, EMM and kiosk fleets it has no direct management role. Because it underpins E2EE key verification for messaging apps that use the platform API, removing or disabling it could break that verification on devices where such apps are used, so treat it with caution rather than debloating it by default. Note that the exact Android version and the split of responsibility between this AOSP provider and the Play-delivered Key Verifier could not be fully sourced and should be confirmed against the device build.

• E2eeContactKeysManager - Android Developers reference →
• Android System Key Verifier - Android Developers →
• platform/packages/providers/ContactsKeysProvider - Git at Google →

• Re-signed by each device maker with its own platform key - 20 different certificates appear across 11 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall.
• Its largest observed manifest declares 1 permissions: 1 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.