The vault passphrase: your key, sealed under words you type

Passcode and passphrase are different things

Most people expect the code they type to be what unlocks the encryption. Here, by default, it isn’t.

Your passcode is a gate in front of the app. It is not part of the key. Your vault key is a random 256-bit key. It is not made from your passcode.

That design keeps the encryption strong even when the passcode is four digits. It also means the key itself sits on the phone, ready for the app. Without Maximum Security, the app can read your vault key whenever the phone is unlocked, because the key sits in the Keychain.

A vault passphrase changes that.

What the passphrase does

With a vault passphrase, your vault key is sealed under a passphrase you type every time the vault unlocks, and if you lose it only your recovery key opens the vault.

The vault key is sealed with AES-GCM under a key made from the passphrase by PBKDF2-HMAC-SHA256 at 1,000,000 rounds.

In plain words: the phrase you type is stretched by a slow calculation into a second key, and that key locks your vault key. Every guess at the phrase has to go through the same slow calculation, which is what makes guessing a long phrase so costly.

The rules

A vault passphrase must be at least 12 characters, needs your recovery key saved first, and can’t be on together with Maximum Security or Dual Lock. The recovery key comes first because it is the only way back if the phrase is lost.

What unlocking looks like

• Your passcode or pattern still comes first. With a vault passphrase on, you enter your passcode or pattern first and then type the passphrase, and a wrong passphrase counts as a wrong try.
• Your face alone no longer opens it. With a vault passphrase on, Face ID or Touch ID alone can’t open the vault.
• Every unlock takes a moment longer. The slow calculation that guards the phrase runs each time you type it.

Choosing a phrase

• Use four or five unrelated words, not a line from a song or a quote. Lines that people like are lines that people guess. Sealed asks for a passphrase rated Strong, and suggests a few unrelated words.
• Make it something you can type on a phone keyboard without errors, every time you open the vault.
• Don’t reuse a password from anywhere else.
• Write it down once, and keep it apart from your phone, until you are sure your fingers know it.

Turning it on

1. Save your recovery key and confirm it. The recovery key page explains how.
2. Turn off Maximum Security and Dual Lock if either is on.
3. Dual Lock, Lock Screen, Maximum Security and Vault Passphrase are in Settings, under Passcode & Unlock, in the Extra Protection section. Tap Vault Passphrase, then Turn On, and type your phrase twice.
4. Lock the vault and open it once with the phrase, to check.

Passphrase or Maximum Security

Both take the key off the shelf, in different ways. A passphrase ties the key to something you know. Maximum Security ties it to your face or finger. Maximum Security seals your vault key to a Secure Enclave key that can be used only after a live Face ID or Touch ID match. Pick the one that fits how you open the vault every day.

Free or Pro

The vault passphrase is part of Sealed Pro.

Where Sealed helps, and where it doesn’t

It helps keep your vault key sealed until you type the phrase, so a phone that is merely unlocked doesn’t hold a ready key. With a vault passphrase, your vault key is sealed under a passphrase you type every time the vault unlocks, and if you lose it only your recovery key opens the vault.

It doesn’t do these things:

• Get you back in without the phrase or the recovery key. Because your key never reaches us, we cannot recover your vault or reset your passcode for you.
• Work together with Maximum Security or Dual Lock. A vault passphrase must be at least 12 characters, needs your recovery key saved first, and can’t be on together with Maximum Security or Dual Lock.
• Make a short phrase strong. The slow calculation slows each guess, it can’t add words you left out. The vault key is sealed with AES-GCM under a key made from the passphrase by PBKDF2-HMAC-SHA256 at 1,000,000 rounds.
• Protect a copy you export. Your files never leave your iPhone unless you turn on iCloud backup or export them yourself.
• Come with the free plan. The vault passphrase is part of Sealed Pro.