How SnapLockr Encryption Works

At a glance

The master key and your passcode

When you create a vault, SnapLockr generates a random 256-bit master key on your device. Every photo and video is encrypted with it using AES-256-GCM, with a fresh random nonce for each item. The master key never changes for the life of the vault.

The master key is never stored as it is. It is stored only wrapped — sealed with AES-GCM under a key-encryption key derived from your passcode with PBKDF2-HMAC-SHA256 at 600,000 iterations and a 32-byte random salt. That iteration count follows current OWASP guidance and makes each guess deliberately slow.

Your passcode itself is never stored, not even as a hash. When you unlock, SnapLockr derives the key-encryption key from what you typed and tries to unwrap the master key. A wrong passcode fails AES-GCM's authentication tag, so the tag is the only verifier — there is no stored value on the device to extract or test guesses against offline.

The design has a useful side effect: changing your passcode is instant. SnapLockr unwraps the master key with the old passcode and re-wraps it with the new one. No media is rewritten, so there is no half-finished state if something interrupts it.

Face ID and Touch ID

In many vault apps, Face ID is a screen you can skip past: the app checks a yes-or-no answer and then shows you the photos. In SnapLockr a biometric match is a cryptographic gate. Turning on Face ID stores a copy of the master key in the Keychain under an access control of .biometryCurrentSet with WhenPasscodeSetThisDeviceOnly.

The Secure Enclave only releases that item after a successful match. If the enrolled faces or fingerprints change — someone adds their own — the item is invalidated and the vault falls back to the passcode. And because it is this-device-only, it never syncs or appears in a device backup.

The recovery code

At setup SnapLockr shows a recovery code once: 24 characters in six groups of four, about 120 bits of randomness. It wraps its own copy of the master key with its own salt, independent of your passcode, so it keeps working after you change the passcode.

Nobody else holds a copy of your key, so nobody else can reset it. Lose both the passcode and the recovery code and the vault cannot be opened — by you, by us, or by anyone. Store the code in a password manager or somewhere physically safe.

Guessing the passcode

Repeated wrong passcodes trigger escalating delays. The attempt counters are kept in the Keychain rather than in the app's memory or preferences, so force-quitting or backgrounding the app does not reset them.

You can also turn on Emergency Erase, which destroys the vault's keys after 10, 15 or 20 consecutive failures. Once the keys are gone the ciphertext is unrecoverable, and the recovery code will not bring it back — so it is off by default.

What is encrypted, and with what

Text recognition runs on the device at import, so you can search for words inside a photographed document. That text is often the most sensitive thing about an image, so it is encrypted with the vault key like the image itself.

On the device, album names and original filenames are stored in the app's database under iOS Data Protection rather than the vault key. They are unreadable while the phone is locked, but they are not behind your SnapLockr passcode, so neutral album names give away less.

Writing to a locked vault

Two features have to add to the vault while it is locked, when the master key is not available: break-in photos, taken after a wrong passcode, and the share extension, which lets you send media to SnapLockr from any app.

Both use public-key encryption. A Curve25519 public key is stored in the clear; each item is sealed with an ephemeral Curve25519 key agreement, a key derived with HKDF-SHA256 that is bound to both public keys, and AES-GCM. The matching private key is itself sealed with the master key, so it is only usable after a successful unlock. The share extension can add to your vault and cannot read it — its only entitlement is the shared App Group.

The decoy vault

A decoy PIN opens a second vault with its own independent master key and key envelope. A decoy envelope always exists: one is created at setup with a passcode that is generated and immediately discarded. Its presence on the device therefore says nothing about whether you set a decoy PIN.

When media leaves the vault

• Viewing and sharing. Video playback and the share sheet need a real file, so SnapLockr writes a temporary decrypted copy with iOS complete file protection into one scratch directory, and deletes it when the vault locks.
• Wireless transfer. The phone runs an HTTPS server with a P-256 certificate it generates itself, valid for one day. Your browser will warn that the certificate is not from a public authority; compare its SHA-256 fingerprint with the one SnapLockr shows. Each session has a new random password, and the server stops when you leave the screen or background the app.
• USB transfer. Exports are decrypted files in the app's Documents folder so your computer can read them. Clear them as soon as the copy finishes.
• Exports. Anything you export or share is an ordinary file from then on, protected only by wherever it ends up.

Encrypted iCloud backup

Backup uploads the ciphertext the vault already holds to your own private iCloud database. Album names, filenames and media types are sealed into one encrypted blob per record, so no CloudKit field gives away what the vault is for.

The master key lives in the Keychain under a this-device-only setting, so it never syncs on its own. The wrapped key envelope is backed up instead. It is useless without your passcode: on a new device the envelope comes down first, you enter the passcode, and everything else decrypts locally. See moving a vault to a new iPhone.

What SnapLockr does not protect against

No app can protect against everything, and it is worth knowing where the edges are.

• A compromised device. Malware or a jailbreak running while the vault is unlocked can see what you see.
• Someone watching you type. A passcode seen over your shoulder opens the vault. Use Face ID in public, a passphrase rather than a short PIN, and change the passcode if you think it has been seen — it takes a second.
• Copies outside the vault. Originals left in Photos or Recently Deleted, photos inside chat apps, and anything you have exported are outside SnapLockr's protection.
• A lost passcode and recovery code. This is the cost of nobody else holding your key. There is no back door, so there is no way back in.