How Vaultwize protects your files, and where it stops.
Files are encrypted on your phone before they are written. There is no account, and no Vaultwize server stores or sees them. This page is the short version of the design, including what it does not protect.
[External review: confirm status before launch.]
Who it protects you from
| Who | Protected | How |
|---|---|---|
| Someone holding your unlocked phone who opens the app | Yes | Unlock code, lock on leaving the app, disguised icon |
| Someone forcing you to open the app | Yes | Other libraries, emergency code, no list or count of libraries in the app |
| A forensic copy of the app's files, without the phone's secure storage | Yes | Everything is ciphertext, and a secret in Keychain or Keystore is needed to even try a code |
| A forensic extraction that includes the phone's secure storage | Partly | Each guess costs an Argon2id run. Short PINs do not resist this, and the number of libraries becomes visible |
| Your cloud provider reading your backups | Yes | Ciphertext only. The backup key comes from a 128-bit recovery secret, never from your code |
| Someone watching your network | Yes | Only ciphertext travels, over TLS |
| Malware or root on the phone, a compromised OS, keyloggers, shoulder surfing, hardware attacks, comparing two forensic snapshots | No | Out of scope |
How files are encrypted
| Purpose | Design |
|---|---|
| Library, files, index | XChaCha20-Poly1305-IETF through libsodium, a random master key per library |
| File format | 64 KiB chunks, padded with PADMÉ, at most about 12% overhead |
| Your code | Argon2id v1.3, floor opslimit 3 and 64 MiB, raised during setup to about 0.7 s per guess on your device |
| Device secret | 256 bits in Keychain or Keystore, combined with the stretched code |
| Recovery phrase | 128-bit secret per library, shown as 12 BIP-39 words |
| Trusted-contact recovery, v1.1 | SLIP-0039, default 2 of 3 shares |
Why the length of your code matters
If an attacker extracts everything including secure storage, only the cost of guessing is left. These are estimates for one guessing stream at about 0.7 s a guess, not benchmarks. Parallel hardware divides them.
| Code | Search every option |
|---|---|
| 6-digit PIN | About 8 days |
| 8-digit PIN | About 2.2 years |
| 4 random words | About 400,000 years |
What stays visible
- That Vaultwize is installed and at least one library exists.
- The total number and padded sizes of stored files. A small library next to a lot of ciphertext suggests other data, so deniability holds against someone holding your phone, not against a forensic examiner comparing volumes.
- File timestamps.
- In Google Drive: one backup set per backed-up library, padded sizes, counts and times.
What third parties receive
| Who | When | What |
|---|---|---|
| App Store and Google Play | When you buy Pro | Purchases |
| RevenueCat | When you buy or restore Pro | An anonymous app user ID, purchase receipts, device or platform data [confirm against RevenueCat's disclosure] |
| Google Drive | Only if you turn on Drive backup | Encrypted blobs, their padded sizes, count and timestamps, and your Google identity |
| Google ML Kit | Only while Find photos to move runs | Usage and performance metrics, not images |