Your pattern produces the encryption key. Two-factor authentication adds a second check after that. Even if someone learns your pattern, they must pass Face ID, enter the PIN, or use your hardware key. The vault opens only after both checks pass.
The fastest second factor. Your face or fingerprint unlocks the vault in under a second. Biometric data never leaves your device's Secure Enclave.
FastestA separate six-digit code, independent of your iPhone passcode. A code you know, no biometric hardware required, works in any conditions.
SimplestA physical hardware key you tap against your phone. Even if your phone is stolen or infected with malware, the key itself is separate. The only factor that is not on the phone at all. Read more about YubiKey.
Most isolatedTwo-factor authentication in ArkWarden is not a sign-in screen with a code from your email. It is a second check that runs after your pattern has already produced the encryption key. The order matters.
You draw your pattern. ArkWarden runs the key derivation, the candidate key tries to unwrap the master key, and either the unwrap succeeds or it does not. If it fails, you never see the second factor screen, because there is no master key to protect at that point. This is how the cryptography decides that the pattern was correct.
If you have a second factor enabled, ArkWarden does not show you the vault yet. It hands control to the second factor flow:
The vault stays locked until the second factor returns a clear success. Cancel, fail it, or close the app and you go back to the lock screen.
The second factor passes, the vault appears, and the master key stays in memory until you lock the app or close it. The next time you return, the full sequence runs again from the beginning. Pattern first, second factor second, every time.
ArkWarden does not implement its own biometric matching, comparison logic, or FIDO stack. Each method goes through Apple's frameworks or Yubico's SDK. We use the standards as designed, with no shortcuts.
A single factor is a single point of failure. Two factors split the failure modes. Someone who observes your pattern still cannot get in. A lost phone still cannot get in. Both factors have to be yours.
| Pattern only | Pattern + Face ID | Pattern + PIN | Pattern + YubiKey | |
|---|---|---|---|---|
| What you need to unlock | The pattern | Pattern and your face | Pattern and six digits | Pattern and the physical key |
| Resists shoulder surfing the pattern | No | Yes | Yes | Yes |
| Works in low light or with a mask | Yes | Sometimes not | Yes | Yes |
| Factor remains separate from a cloned device | Depends on method | Yes. Biometrics bound to Secure Enclave. | Yes. PIN does not migrate to other devices. | Yes. Hardware key is separate equipment. |
| Factor is not on the phone at all | No | No | No | Yes |
| Convenience | Highest | Highest | High | Slightly slower (NFC tap) |
Your pattern decides whether the encryption opens. Your second factor decides whether the vault is shown after the pattern succeeds. Splitting these two responsibilities is what makes the combination stronger than either control alone.
Pick Face ID if your main concern is casual access, a lost phone, or someone who knows your pattern from watching you draw it. Pick a PIN for a code you know with no biometric dependency. Pick a YubiKey for a factor that is not on the phone at all. ArkWarden supports all three, and you can change your choice later.
Some people want maximum convenience. Some people want maximum protection. ArkWarden lets you choose. You can use the pattern alone, which is already a serious cryptographic system. You can add a second factor at any time from Settings. You are not pushed into either choice during onboarding. If you use a YubiKey and lose it, your recovery phrase lets you bypass 2FA and regain access.
ArkWarden supports three methods. Pick the one that fits how you actually use your phone.
ArkWarden uses Apple's LocalAuthentication framework for biometric verification. The actual matching happens inside the Secure Enclave, a dedicated security chip on your iPhone. The Face ID or Touch ID data never enters the regular iOS file system, never touches ArkWarden's process memory, and never leaves the device.
What ArkWarden gets back is a binary result: success or failure. We do not see the biometric template, we do not see partial scores, and we do not see what the camera saw. The full biometric path runs inside Apple's security boundary.
The PIN is a six-digit secret you choose during setup. It is stored on your device, with the iOS accessibility class that requires the device to be unlocked and prevents migration to a different device. There is no cloud copy and no sync.
The PIN is independent of your iPhone's own passcode. Setting a PIN inside ArkWarden does not change anything about your iPhone's lock screen, and changing your iPhone's passcode does not change anything inside ArkWarden. We recommend picking a different value for each so the two systems remain fully independent.
A YubiKey is a small physical security key made by Yubico. ArkWarden talks to it using FIDO2 / WebAuthn, the same standard used by Google, Microsoft, and financial institutions worldwide for their highest-value accounts.
When you register a YubiKey, the key generates a public and private key pair internally and gives ArkWarden the public key. The private key never leaves the YubiKey. At unlock time, ArkWarden sends the YubiKey a random challenge, the YubiKey signs it using the internal private key, and ArkWarden verifies the signature. This means:
You can register up to two YubiKeys per vault. The second key is a backup. If you misplace one, the other still works. For the full setup flow, screenshots, and recovery details, see the YubiKey page.
| Part | What it does | Where the secret is stored |
|---|---|---|
| Pattern | Produces the encryption key through key derivation | In your head and your muscle memory |
| Master key unwrap | Authenticated decryption that opens only for the right derived key | Wrapped master key in the iOS Keychain, encrypted at rest by the Secure Enclave |
| Face ID or Touch ID | Verifies the face or fingerprint | Biometric template inside the Secure Enclave, never seen by ArkWarden |
| PIN | Matches the six digits you set | Stored in the iOS Keychain, encrypted at rest by the Secure Enclave, device-locked |
| YubiKey | Signs a fresh random challenge with FIDO2 / WebAuthn | The signing key is stored on the YubiKey itself, not on the phone |
You can switch methods at any time from Settings. Switching does not re-encrypt your files, because the encryption is tied to your pattern, not your second factor. The second factor is a verification check before the unlocked vault is shown. Changing it changes the check, not the encryption.
Your pattern is the encryption key. Your second factor is an additional check before the vault opens. Choose the method that works for you. ArkWarden supports all three, and you can change it at any time.
