VaultCave

How VaultCave protects your files

What the encryption does, and what it can’t do. No marketing claims.

Last updated: 2026-11-02

This page explains how VaultCave protects your files, and just as plainly, what it can't protect against.

The short version

  • Everything in a vault is encrypted on your iPhone with AES-256-GCM.
  • The key comes from your pattern or passcode, stretched with PBKDF2-HMAC-SHA256 (600,000 iterations) and bound to a secret held by your iPhone's Secure Enclave. Without both, the files are unreadable.
  • There is no account and no VaultCave server holding your data. We can't read, reset or recover your vaults.
  • Nothing on disk lists your vaults. A vault is found only by deriving its key from the right pattern.

How a vault is protected

Your pattern or passcode is part of the key. When you draw your pattern, the app derives a key from it and from a device secret in the Secure Enclave. That key unwraps the vault's random 256-bit master key, which in turn unwraps a separate key for every file. A wrong pattern simply produces a key that opens nothing.

Every file is encrypted in chunks with its own key, and each chunk is authenticated together with its position and the file's identity. Altering, reordering, swapping or truncating encrypted data makes it fail to open rather than open wrongly. Thumbnails, file names, folders and the vault's index are encrypted too.

Hidden vaults. On-disk names are random-looking. There's no list of vaults anywhere; the app finds a vault by computing its location from the pattern you draw. Someone examining the device can't tell how many vaults exist, or which pattern belongs to which.

Guessing is slowed down, and only works on this iPhone. Because the key needs the device's Secure Enclave secret, copied files can't be attacked on a computer. On the device, wrong attempts trigger growing delays (30 seconds after 5, up to 15 minutes), and after 10 the pattern stops working and the recovery phrase is required, or, if you turned it on, every vault on the device is erased. The counter is stored in the Keychain, so reinstalling the app doesn't reset it, and changing the clock doesn't skip a delay.

Your recovery phrase is 12 words generated for you (BIP39 word list). It's the other way to unlock a vault, and the only way to restore one from backup. It's shown once and never stored on the device.

Backup

The optional iCloud backup goes to your own iCloud private database. Everything is encrypted before upload, records have random names, and sizes are padded into fixed classes so they don't hint at what's inside. Nothing links backup records to each other or to a vault without the recovery phrase. Restoring needs the phrase, never a pattern, so an attacker who triggers an erase can't simply restore your vault and keep guessing.

What someone with access to your Apple ID can do: delete the backup. What they can't do: read it.

Duress mode

You can set up a decoy vault with believable content and its own pattern. Opening it at the unlock screen opens the decoy normally and, at the same moment, crypto-erases every other vault on the device (their keys are destroyed first, then the files are removed in the background). There's no alert and no visible change. Your real vaults come back only from an encrypted backup with their recovery phrases.

What VaultCave can't protect against

We think a security app should say this out loud:

  • Screenshots and screen recording. No iPhone app can block them. VaultCave hides its content from the app switcher and covers the screen while it's being recorded or mirrored, but it can't stop a screenshot or a camera pointed at the screen.
  • Someone watching you unlock. If someone sees your pattern, they can open that vault. Choose a pattern that isn't obvious and unlock out of sight.
  • A compromised or jailbroken device. If the iPhone itself is compromised while a vault is open, its contents can be exposed.
  • Exports. Files you export or share without encryption are readable wherever they go.
  • Coercion beyond duress mode. Duress mode helps, but an attacker who already knows you use VaultCave may suspect a decoy.
  • The app being visible. Disguised icons change the icon, but iOS still shows the name VaultCave under it, and shows an alert when the icon changes.
  • Forgetting both your pattern and your phrase. Then nobody can get the vault back, including us.

Privacy

There are no analytics, ads or trackers, and the app collects no data. See the Privacy Policy.

Reporting a vulnerability

If you find a security issue, please email support@vaultcave.app with "Security" in the subject. We'll acknowledge it promptly and credit you if you'd like.