How your vault stays sealed.

From a pattern to a key

When you draw your sigil, Sigilock turns the sequence of dots into key material on the phone. The pattern itself is never stored. It is first mixed, with HKDF, with a 32-byte secret generated on your phone and held in the iOS Keychain or Android Keystore. That secret never leaves the device, so a copy of the app’s files alone isn’t enough to start guessing.

The result is then deliberately slowed down. Sigilock runs it through a chain of hardware-accelerated AES-GCM rounds over 4 MiB blocks, each round keyed by the last one’s tag, so no step can be skipped or run in parallel. The number of rounds is calibrated on each phone to take around 0.7 seconds. You won’t notice it once; someone trying patterns one after another notices it every time.

pattern ──HKDF(salt = 32-byte device secret in Keychain/Keystore)──► k₀
k₀ ──N rounds: AES-GCM(4 MiB zeros) → kᵢ₊₁ = HKDF(kᵢ, GCM tag)──► seed
                                          (N calibrated to ~0.7 s on each phone)
seed ──HKDF──► slot id  +  wrap key ──► slots/p-<id> = AES-GCM(master key)
recovery phrase (128-bit) ──HKDF──► slots/r-<id> = AES-GCM(same master key)
master key ──► encrypted index (items, per-file keys, notes, albums)
per-file key ──► vaults/<id>/blobs/<item>   (1.5 MiB chunks, STREAM nonces)

Vaults, slots and deniability

Each vault has a random 256-bit master key. Your sigil and your recovery phrase each unlock their own “slot”, a small encrypted record that contains that master key. Slot names are derived from the sigil itself, so nothing on disk says which slot belongs to which vault, or which vaults are decoys. A pattern that matches no slot opens nothing: the lock screen says so, and the attempt goes into your intruder log.

Duress mode works at this level: opening the duress vault deletes the pattern slots of every other vault on the phone. The vaults themselves stay intact and encrypted, and each can be reopened later with its recovery phrase.

Files, thumbnails and notes

• Every item gets its own random key and is encrypted with AES-256-GCM in 1.5 MiB chunks using STREAM nonces, so chunks can’t be reordered, swapped or cut short without detection.
• The vault index (your item list, per-file keys, notes and album names) is encrypted with the master key.
• Thumbnails are decrypted into memory only, and the image cache is set never to write decrypted pixels to disk. Videos and documents you open decrypt to a temporary folder that is wiped on every lock and at launch.
• Copies made by the photo picker and the camera are deleted right after encryption.

The recovery phrase

Each vault has a 12-word phrase from the standard BIP-39 word list, carrying 128 bits of randomness. It unlocks its own slot, independent of the phone’s secret, which is what lets you reopen a vault on a new phone. Viewing it again inside the app requires drawing your sigil.

What Sigilock protects against

• Someone who picks up your phone, even unlocked: the vault needs your sigil, not your passcode.
• Someone who insists you open it: hand over a decoy, or use your duress sigil.
• Someone who copies the app’s files off the phone: everything is ciphertext, and every guess at a pattern needs the phone’s own secret plus the slow key derivation.
• Glances at the app switcher, screenshots and screen recordings.
• Someone watching you draw, when you turn on the hidden trail.

And what it can’t

• Malware or a compromised operating system with full control of the phone while a vault is open.
• Losing both your sigil and your recovery phrase. Nobody can open that vault, by design.
• Someone with file-system access counting vault folders. They can see how many exist, not which pattern opens which, or what is inside.
• Anyone you show your photos to. No app can stop a camera pointed at a screen.

What leaves your phone

None of your vault data. The app has no account and no analytics. The only network traffic is checking your subscription: purchases go through Apple or Google, and RevenueCat confirms your plan using an anonymous ID and your receipts. See the privacy policy for details.

What’s next

We plan to replace the AES-chain key stretch with native Argon2id, a memory-hard function that makes guessing more expensive still on specialized hardware. Encrypted backup to your own iCloud or Google Drive will upload only ciphertext, unlockable with your recovery phrase.

Report a vulnerability

Send us a security report with the steps to reproduce, and please allow reasonable time for a fix before public disclosure. Contact details are also in our security.txt.