SECURITY · 3 NOVEMBER 2026
How Vaultage protects your vault
In one paragraph
Every item you add is encrypted on your iPhone or iPad before it is stored. The key that unlocks the vault is derived from your vault password, PIN, or pattern combined with a secret that never leaves the device. There is no account, no Vaultage server, and no cloud copy. Your device passcode does not open the vault, and nobody, including us, can reset a forgotten vault credential.
What it protects against
- Someone using your unlocked phone. The vault has its own credential, so knowing your iPhone passcode is not enough.
- A copy of the vault's files. Copied vault data reveals no files, thumbnails, filenames, or metadata, and cannot be guessed offline even with a six-digit PIN, because the key also depends on a secret stored in the device Keychain that is not included in backups or transfers.
- Tampering. Every encrypted item is authenticated. Altered, truncated, or reordered data is detected before anything is displayed.
- Glances at the app switcher. iOS app-switcher snapshots do not show vault content.
- Leaving the vault open. The vault locks when the app goes to the background, and the keys are cleared from memory.
- Repeated guessing. After five wrong attempts, Vaultage waits 30 seconds, rising to one hour after the ninth. It never wipes the vault automatically.
How it works
- Encryption: AES-256-GCM for every item, in 1 MiB chunks, with a separate key derived for each file.
- Keys: your credential goes through PBKDF2, and the result is combined with a per-device secret using HKDF. That device secret is stored in the Keychain as available only on this device while it is unlocked.
- Metadata: filenames, the item list, and the search index are encrypted too. Text recognised in your photos is never shared with Spotlight, iCloud, or any server.
- Temporary files: when a video plays or a file is previewed, any decrypted temporary copy lives in a temporary folder that is cleared on lock and on launch.
- Backups: an encrypted backup file is protected by a separate backup password of at least 12 characters, chosen by you.
What no vault can protect against
Being clear about limits is part of being trustworthy:
- A compromised or jailbroken device can observe the app while the vault is unlocked.
- Forensic extraction of both the vault and the Keychain from the device removes the device-secret protection. A PIN or pattern can then be guessed offline; a long password cannot practically be. Use a password if this matters to you.
- Exported copies. When you export an item, the copy outside the vault is not encrypted.
- Someone who knows your vault credential or watches you enter it.
- The Photos app. After importing, the original is still in Photos until you delete it, and iOS controls its Recently Deleted album.
Our commitments
- No telemetry, crash reporting, remote configuration, or sync without a public product decision.
- The vault stays excluded from device backups.
- Website and App Store copy will not claim more than the app does.
Vaultage has not yet had an independent security audit. We will publish the result here when it has.
FAQ
Can Vaultage see my photos?
No. Nothing is sent to us. The vault and its keys are only on your device.
What encryption does Vaultage use?
AES-256-GCM, with keys derived from your credential using PBKDF2 and HKDF and bound to a secret held in your device's Keychain.
What happens if I forget my vault password?
The vault cannot be opened or recovered. If you made an encrypted backup, you can restore it into a new vault with the backup password. See why there is no password reset.