Security architecture

The short version

Everything in a vault is encrypted on your phone. The key comes from your path, made slow to guess with Argon2id and tied to your phone's security hardware. Files are encrypted in small chunks with AES-GCM, so videos can be played without decrypting the whole file, and any tampering is detected. There is no account and no server holding a copy of your keys.

Layer by layer

1. Your path. The cells you trace are turned into bytes. A path has at least eight cells.
2. Argon2id. The path is stretched with Argon2id using 64 MiB of memory and two passes. This makes each guess slow and memory-hungry, which hurts large-scale guessing.
3. Hardware binding. The result is mixed with a secret that never leaves the Secure Enclave (iPhone) or the Android Keystore, using StrongBox where the phone has it. So guesses can only be tried on your phone, at your phone's speed.
4. Master key. Each vault has its own random 256-bit master key. It's stored only in encrypted form, locked by the key from your path.
5. Chunked AES-GCM. Items are encrypted with AES-256-GCM in 1 MiB chunks. Each chunk is tied to its item and position, so chunks can't be swapped, reordered or cut short without failing to open.

What this protects against

• Someone picking up your phone and opening the app without your path.
• Someone copying the app's files off the phone and trying guesses on a fast computer.
• Someone altering encrypted files to change what you see.

Honest limits

• An independent security audit is planned before launch. It hasn't been done yet.
• Backups and shares don't use the hardware binding, so they can be opened on another phone. Their safety rests on a strong path or phrase and Argon2id.
• If your phone itself is compromised by malware, or someone watches you trace your path, encryption can't help.
• Someone with deep access to the app's files could count encrypted vault folders.

The security page has the full threat model.

Questions