Open source

Read the code that
protects your files.

A vault is only as trustworthy as the code that protects it. The encryption that protects your files is open source. You can read the code yourself, or ask someone you trust to check it.

The reason

Why the code is open.

Most security apps ask you to believe them. They describe how strong their encryption is, and you have no way to check whether the words match the code. You are trusting a claim, not a fact.

We did not want to ask for that kind of trust. So the part of ArkWarden that protects your files is public. Anyone can read it, study it, and confirm that it does exactly what we say it does, and nothing else.

Open code does not make an app secure on its own. What it does is let you verify our claims about the main vault's encryption. If one of those claims is not true, the code will show it.

What is public

What you can read.

We publish the code that encrypts files in your main vault. This is the part worth checking.

  • Key derivation. The code that derives an encryption key from your pattern or recovery phrase, using PBKDF2 with a per-vault random salt.
  • File encryption. How each file is encrypted with AES-256-GCM, and how the index is encrypted with ChaCha20-Poly1305.
  • Master key encryption. How a random master key is encrypted under your pattern or recovery phrase and stored in the iOS Keychain.
  • Key storage. How keys and salts are written to the iOS Keychain and marked so they stay on your device.
  • Recovery phrase. How the recovery phrase is built from the BIP-39 wordlist.

Wing is an optional second vault with its own pattern and files. It is not part of this repository. How Wing works is described on the Wing page and in the security overview.

Check it yourself

How to verify the claims.

1

Open the code

Go to the repository on GitHub. The code that encrypts files in your main vault is in one place, written to be read.

2

Match it to the claims

Read the security overview and the encryption page, then find the same steps in the code. The standards we name are the standards you will see.

3

Ask someone you trust

You do not have to be a developer. Anyone with the right background can read the code and tell you whether it does what we say.

To be clear

What open source does and does not mean.

  • We publish main vault encryption, not the entire app. The code that protects your files is public. The interface, onboarding, and other parts of the app are not in this repository.
  • Wing is documented, not published here. Wing is an optional second vault with its own pattern and files. How it works is on the Wing page. Its implementation is not part of this repository.
  • Open code is not a guarantee on its own. It lets you verify our claims. It does not by itself prove there are no bugs. We treat the published code as the version that should be checked.
  • Found a problem? Tell us. Email hello@arkwarden.app with "security" in the subject. We want to hear about it.
Open source

See it for yourself.

The code that protects your files is public. Read it, study it, or ask someone you trust to look.

Read the security overview