Security
Real encryption. No servers. No back doors.
Personal Vault was designed so that the only person who can open your vault is you — not us, not a cloud provider, not anyone who steals a database.
Key hierarchy
From your PIN to your data
Each layer protects the next. Without your PIN or enrolled biometrics, the vault is unreadable ciphertext.
Layer 1
Your PIN or biometrics
A 4–8 digit PIN, or fingerprint/face unlock gated by the Android Keystore.
Layer 2
PBKDF2-HMAC-SHA256
210,000 iterations with a random 16-byte salt turn your PIN into a key-wrapping key.
Layer 3
256-bit master key
Randomly generated on your phone, stored only in wrapped form in the Android Keystore.
Layer 4
Encrypted vault
SQLCipher database, plus every item sealed with AES-256-CBC and verified with HMAC-SHA256.
Built-in protections
Defence in depth, switched on by default
PIN never stored
Only a derived, wrapped key exists. There is no password hash to steal.
Auto-lock
The vault locks shortly after you leave the app, and the master key is cleared from memory.
Recent-apps privacy
Vault contents are hidden behind a privacy overlay in Android's app switcher.
Brute-force lockout
Repeated wrong PINs trigger escalating waits, with an optional erase-after-failures setting.
Clipboard auto-clear
Copied passwords and codes are wiped from the clipboard after 30 seconds.
No cloud auto-backup
Android's system backup is disabled, so your vault isn't silently copied to any cloud.
Encrypted backups
- Backups are encrypted on your phone before they are written anywhere.
- Add a backup password (PBKDF2-derived key) so a backup can be restored after reinstalling or on a new phone.
- Automatic backups skip uploading when nothing changed and keep your 10 most recent automatic copies.
Every network connection, listed
Your vault contents are never part of any of these.
| Purpose | Service | What happens |
|---|---|---|
| Ads | Google AdMob | Request non-personalised ads. |
| Update check | Google Play | See whether a newer app version is available. |
Honest limits you should know about
- A forgotten PIN can't be reset. Without biometrics or a password-protected backup, your data is gone for good. That's what zero-knowledge means.
- Plain exports aren't encrypted. JSON, CSV, ZIP and PDF exports are readable by anyone who gets the file. Prefer encrypted JSON.
- A compromised device is out of scope. Malware with root access, or someone watching you type your PIN, can defeat any app.
- Screenshots aren't blocked yet. Be mindful of screen recording and screenshot tools while the vault is open.
Found a vulnerability?
We welcome good-faith security research and offer safe harbour for responsible disclosure.
Machine-readable contact: security.txt