Every file you encrypt gets its own unique encryption key. This means your files are isolated from each other, so one file's security has no bearing on another's.
Your PIN never touches our servers, and it is never written to disk in any form. When you unlock the vault, your device uses Argon2id to derive a key from your PIN, a process deliberately designed to be slow and memory-intensive, making brute-force attempts impractical even if someone gets hold of your device. That derived key briefly unlocks a Master Key held in protected memory, which in turn accesses your file keys. The moment you close the vault or switch away from the app, the Master Key is wiped from memory entirely.
Each file is encrypted with XChaCha20-Poly1305, which both encrypts and authenticates your data. Tampering with an encrypted file is detectable, meaning corrupted or modified files will not open.
Your vault data is stored in a private directory on your device, sandboxed from other apps and inaccessible to file browsers. On Android 10 and above, the operating system adds a further layer of encryption at rest, backed by your device's hardware security. This is a platform-level protection your vault benefits from automatically.
Nothing leaves your device. No file content, no keys, no PIN.
.jpg)
.png)
.svg){kind=small}
.png){kind=icon}
.svg)
.svg)
