Maximum Security: the key opens only for your face or finger

The gap it closes

Your vault key has to live somewhere on the phone. By default it lives where the app can reach it whenever the phone is unlocked.

Your vault key is kept in the iPhone Keychain, on this device only, and it can be read only while the phone is unlocked. Without Maximum Security, the app can read your vault key whenever the phone is unlocked, because the key sits in the Keychain.

For most people that is fine: the phone’s own lock guards the key. Maximum Security is for when you want the key guarded by your face or finger as well.

What it does

Maximum Security seals your vault key to a Secure Enclave key that can be used only after a live Face ID or Touch ID match.

Apple describes the Secure Enclave as a dedicated secure subsystem, isolated from the main processor, designed to keep sensitive user data secure even when the Application Processor kernel becomes compromised.

In plain words, the key is wrapped by a second key that never leaves a separate chip in the phone. That chip unwraps it only after a live match of your face or finger. No match, no key, and without the key the vault’s files are unreadable.

What changes when it is on

• Every unlock ends with your face or finger. With Maximum Security on, every unlock ends with a live Face ID or Touch ID match that releases your vault key.
• Your face alone can open it, unless you also ask for the passcode. With Maximum Security on and Dual Lock off, a Face ID or Touch ID match alone opens the vault, with no passcode. To ask for both, add Dual Lock.
• The decoy needs your face too. With Maximum Security on, even the decoy passcode needs a live Face ID or Touch ID match, because the vault key is only released by one.
• Break-in photos still work. With Maximum Security on, the vault key isn’t available while the vault is locked, so Sealed stores each break-in photo encrypted to a Secure Enclave public key and seals it into the vault the next time you unlock.
• The camera button on Sealed’s own lock screen goes away. The camera button on Sealed’s own lock screen is part of Sealed Pro, and it is not shown while Maximum Security or a vault passphrase is on. That is a different thing from the iPhone’s Lock Screen camera. The Lock Screen camera and the Shortcuts actions keep working with Maximum Security or a vault passphrase on, because they seal photos without needing your vault key.

The cost: your recovery key becomes essential

In iOS, a key protected with biometryCurrentSet is invalidated if the person re-enrolls Face ID, or adds or removes fingers for Touch ID.

So if you set up your face again, or add or remove a finger, the wrapped key can no longer be unwrapped. That is by design. Before you can turn on Maximum Security, Sealed asks you to save your recovery key, because it is the only way back in if your Face ID or Touch ID ever changes.

Treat this as the one rule of Maximum Security: save your recovery key, and keep it somewhere off the phone, before you turn it on. The recovery key page explains where.

Turning it on

1. Save your recovery key and confirm it.
2. Turn on face or fingerprint unlock in the app. Maximum Security can be turned on only while Face ID or Touch ID unlock is on, because it seals your key to it.
3. Dual Lock, Lock Screen, Maximum Security and Vault Passphrase are in Settings, under Passcode & Unlock, in the Extra Protection section. Turn on Maximum Security there, and confirm with your face or finger.

Maximum Security needs an iPhone or iPad with Face ID or Touch ID.

On a new phone

A new iPhone cannot inherit the Maximum Security binding of the old one, so you restore with your recovery key. After a restore with your recovery key, Maximum Security is off, and you turn it on again in Settings.

So after a move, turn it on again on the new phone.

Maximum Security or a passphrase

Both stop the key from sitting ready on the phone. One ties it to your face, the other to words you type. A vault passphrase must be at least 12 characters, needs your recovery key saved first, and can’t be on together with Maximum Security or Dual Lock. The vault passphrase page compares the two.

Free or Pro

Maximum Security is part of Sealed Pro.

Where Sealed helps, and where it doesn’t

It helps keep your vault key sealed until a live match of your face or finger, so an unlocked phone alone doesn’t hand it over. Maximum Security seals your vault key to a Secure Enclave key that can be used only after a live Face ID or Touch ID match.

It doesn’t do these things:

• Stop someone who can make your face match. With Maximum Security on and Dual Lock off, a Face ID or Touch ID match alone opens the vault, with no passcode. Dual Lock adds the passcode.
• Survive a change to your face or fingers without the recovery key. Before you can turn on Maximum Security, Sealed asks you to save your recovery key, because it is the only way back in if your Face ID or Touch ID ever changes.
• Move to a new phone. A new iPhone cannot inherit the Maximum Security binding of the old one, so you restore with your recovery key.
• Run on a phone without face or fingerprint unlock. Maximum Security needs an iPhone or iPad with Face ID or Touch ID.
• Come with the free plan. Maximum Security is part of Sealed Pro.