VaultMaster
How VaultMaster protects your vault
What is encrypted, what we never have, how guessing is slowed, and, just as important, what VaultMaster does not claim to protect against.
What is encrypted, and how
Photos, videos, files, names, thumbnails and the list of what you have stored are all encrypted on your iPhone with AES-256-GCM. Each vault has its own random master key, kept only inside small files that open with the right pattern or your recovery phrase.
Your pattern is stretched with PBKDF2 (600,000 rounds) and mixed with a secret wrapped by a key inside the Secure Enclave, so copying the files or the Keychain off the phone does not give an attacker everything they need to guess your pattern offline.
What we never have
We never receive your photos, your pattern, your recovery phrase or your keys. There is no account and no server holding your vault, so we cannot recover a vault for you.
Guessing and pressure
New patterns need at least six dots. Five wrong tries bring growing pauses, from 30 seconds up to an hour. You can choose to erase everything after 10 or 20 wrong attempts. An optional duress pattern opens a harmless vault and erases the others. Vaults hide in the app switcher and during screen recording.
Who it is built to stop
A casual snoop with your unlocked phone. Someone who knows you and guesses. A thief with a locked phone. Someone who gets a backup file. A forensic examiner with a copy of the app’s files. Each has a different answer, and our published threat model lists them one by one, including where VaultMaster is weaker.
What it can’t do
We’d rather tell you plainly than have you find out later.
- We cannot stop screenshots, a camera pointed at your screen, or someone watching you draw your pattern.
- Pauses and erase-after-attempts are software limits; a determined attacker who changes the phone’s clock can skip a pause.
- Malware or a compromised iOS while your vault is open is outside what any app can defend against.
- Short or predictable patterns are easier to guess. Use six or more dots in an unusual shape.
- VaultMaster does not back up or sync by itself. Make backups, and keep your recovery phrase safe.
- There has been no independent security review yet, so we do not claim one.
Questions
- Can VaultMaster see my photos?
- No. They’re encrypted on your iPhone and we never receive them, your pattern or your recovery phrase.
- Has VaultMaster been independently audited?
- Not yet. We publish what it does and where it falls short, and we won’t claim a review until one has happened.
VaultMaster is coming soon to the App Store.
All about VaultMaster