Security model

How Sealed encrypts your files

Everything you add to Sealed is encrypted on your iPhone before it's saved. Here's exactly how, and just as important, what it doesn't protect against.

The short version

Your passphrase unlocks a vault key. The vault key unlocks a separate key for every file. The files are encrypted with those keys and stored only on your phone. None of the keys are ever stored unencrypted, and none of them ever leave your iPhone.

// The layers, from what you type to your files
passphrase  ──Argon2id──▶  passphrase key
                     + this iPhone's Keychain secret
                     ──▶  unlocks the vault key (random, 256-bit)
vault key   ──▶  unlocks each file key (random, one per file)
file key    ──XChaCha20-Poly1305──▶  file contents + its details

Your passphrase

Sealed never stores your passphrase. When you unlock, it runs your passphrase through Argon2id with 3 passes over 64 MiB of memory and a random salt. That takes up to about a second on a phone, which you barely notice, but it makes trying millions of guesses slow and expensive. Sealed asks for at least 12 characters and rejects passphrases that are easy to guess.

A key tied to this iPhone

The result of Argon2id is combined with a 32-byte secret that Sealed keeps in this iPhone's Keychain, marked "this device only". That secret is never included in backups and never leaves the phone. So even if someone copied Sealed's encrypted files off your iPhone, they couldn't start guessing your passphrase on a computer: they'd also need that Keychain secret.

Your files

Each file gets its own random 256-bit key. The file is encrypted with XChaCha20-Poly1305 in 64 KiB pieces. Every piece carries a check tied to that file and its position, so a file can't be altered, reordered, mixed with another file or cut short without Sealed noticing.

A large video is encrypted piece by piece as it comes in, so it never has to sit unencrypted in memory all at once.

What's encrypted

• File contents: photos, videos and documents.
• File details: names, types, sizes as recorded in the app, which folder they're in, and when they were added.
• Folder names.
• Files on disk have random names that say nothing about what they are.

What isn't hidden

• Roughly how big each file is. An encrypted file is about the same size as the original.
• How many files you have, to someone with access to the phone's storage.
• That you use Sealed. The app is on your home screen like any other.

Where your files are

Only on your iPhone. Sealed has no server and no account, and the vault folder is excluded from iCloud and device backups. There's no analytics in the app. Purchases go through Apple and are recorded by our payment provider under a random ID that isn't linked to you.

What encryption can't protect against

• Someone who knows your passphrase, or watches you type it.
• Someone holding your phone while the vault is unlocked. That's why Sealed locks itself when you leave.
• Copies you export or share. Once a file leaves Sealed, it's an ordinary file again.
• A phone that's already compromised by malware or a jailbreak.
• A forgotten passphrase without a recovery key. There's no back door, for anyone.