How Cryptile's security works
This page explains the design in plain words. The threat model and the encryption core are published, so you do not have to take our word for any of it. If something here turns out to be wrong, that is a bug we fix in public.
Your pattern is the starting point
You open a vault by drawing a pattern on a grid. The pattern is turned into a key on your device, using a slow, standard method that makes each guess costly. It is mixed with a secret that is generated on your phone and kept in the Keychain on that device. That secret is not in the app's files and not in the iCloud backup, so someone who copies only the encrypted files cannot sit down and try patterns against them.
Everything is encrypted with AES-256-GCM
Photos, videos, documents, thumbnails and the index are each encrypted with AES-256-GCM, a standard cipher that also detects tampering. Large files are cut into chunks, and each chunk is authenticated, so a file that has been truncated or reordered fails to open. Different jobs use different keys derived from a per-vault master key, and no key is used for two purposes.
No account, no server, no keys held by us
Cryptile has no account system and runs no server. Your keys are made on your device and stay there. The developer never holds them, so there is nothing for us to reset, hand over or leak.
Decoy vaults and no vault list
There is no list of vaults. The pattern you draw leads to the vault it belongs to, and any other pattern leads to an empty vault that looks the same as a vault that was never made. That makes a second vault work as a decoy. The app also keeps spare index slots, half of them random and re-rolled whenever you save something, so the files on disk do not reveal how many vaults there are.
File sizes are padded
Small items are padded to a fixed size before encryption, so a short note and a photo thumbnail look alike on disk.
Backup and the 9-word recovery phrase
Backup to iCloud is encrypted on your phone first. Apple stores ciphertext and nothing that opens it. Each vault has its own 9-word recovery phrase, shown when you create the vault. To restore on a new phone, you enter the phrase and then draw a new pattern. There is no email and no reset. If you lose both the pattern and the phrase, the vault is gone for good.
Panic pattern
You can set an extra pattern. Drawing it destroys the device secret mentioned above and re-rolls the decoys, so every vault on that phone stops opening. Each vault can still be restored on a fresh install using its recovery phrase. It is meant for situations where you need access to end quickly.
Open source and published
The encryption core is open source, with a published threat model and test vectors. There is an executable reference version of the design, and the app's code has to produce byte-for-byte the same output as that reference. Any difference is a failing test.
Who this protects you from
- Someone holding your unlocked phone. They see only the vault whose pattern they know.
- Someone with your locked phone. The files are ciphertext, and the device secret sits behind your passcode.
- Someone who copies the app's files. They get ciphertext only, with no sizes and no vault count to learn.
- Apple, or a breach at Apple. iCloud holds ciphertext, not keys.
- Us. We hold nothing.
What it does not protect you from
- Weak patterns under a determined attack. A pattern is not a passphrase. A 6-cell pattern on a 4×4 grid has about 5.7 million possibilities. If an attacker has both your phone's contents and the Keychain, for example because your passcode is known, they can try patterns offline, and a short one falls in minutes on a fast computer. Use 8 or more cells, which is roughly 2 billion possibilities, or the larger grid.
- A compromised phone. Malware that reads memory while a vault is open is outside what an app can defend.
- Someone watching you draw. The trail is hidden by default, but a watcher can still see your hand.
- Losing everything. Lose the device or the pattern and the recovery phrase, and nobody can get the vault back.
- Screenshots. View-once and expiry are kept by the recipient's app. A screenshot defeats them.
Things we disclose
An examiner can see the total size of the container, roughly bucketed. The number of index slots shows an upper limit on vaults, not how many are real. File modification times can hint at activity, so we touch decoys on every save to blur that.