Pattern unlock is how you open ArkWarden every day. You draw a pattern on a 5x5 grid, your vault opens, and you continue. No typing, no password manager, and less risk that someone nearby can read a PIN. Your hand remembers the pattern. The cryptography verifies it. The full unlock takes about a second.
Pattern unlock looks simple on screen by design. After the gesture, ArkWarden runs a small amount of cryptographic work that decides, very fast, whether the vault should open.
The 5x5 grid wakes up. ArkWarden tracks every dot your finger passes through, in order, including the way you connect them. A straight line through three dots in a row is one segment. A line that doubles back, skips a dot, or changes direction is recorded faithfully.
The minimum you can draw is six dots with at least two direction changes. Below that, the app rejects the pattern at setup and asks you to make it stronger. There is no upper cap imposed by the code. You can use as many dots as you want, in any order your finger can manage.
The moment you lift, ArkWarden takes the sequence of dot indices and runs it through the same key derivation function used during vault creation. The derivation mixes your pattern with a random salt unique to your vault, then produces a candidate key.
You feel nothing at this stage. The derivation is fast enough to feel instant on any supported iPhone, but slow enough that an attacker trying millions of guesses would need real time to compute each one.
ArkWarden does not store your pattern. What it stores is a SHA-256 hash of the key your pattern produces, used only to give you fast pass/fail feedback and to count attempts. A matching hash does not by itself open your vault. What happens instead:
That unwrap, not the hash check, is what actually proves the key is correct and releases your files.
With the master key in memory, ArkWarden decrypts the index of your vault and shows you your files. If you have a second factor enabled (Face ID, a PIN, or a YubiKey), it is checked at this point. If you have not enabled one, the vault is now open.
When you lock the app or close it, the master key is released from memory. The next time you draw your pattern, the full sequence runs again from the beginning. The key is never stored, never cached, and never written down anywhere.
A strong password does not help if it is too difficult to use every day. Pattern unlock works because it is fast enough that people actually use it.
| A 4-digit PIN | A typed password | Face ID alone | Pattern unlock | |
|---|---|---|---|---|
| Time to unlock | About a second | Two to five seconds | Under a second | About a second |
| Possible combinations | 10,000 | Depends on the password (often weak) | Not applicable | Billions of possible patterns |
| Resists shoulder surfing | Poor. Easy to read four digits. | Poor. Visible keyboard taps. | Excellent. | Good. Speed and shape complexity make recall difficult. |
| Resists smudge inspection | Limited. Numbers smear obviously. | Good. Many keys touched. | Not applicable. | Good. Dots show but not the order or direction. |
| When someone forces you to unlock | Only one key. No alternative. | Only one key. No alternative. | Forces you to look at the camera. | A second pattern opens a second vault instead. |
| If you forget | Reset, usually with no consequence | Reset, usually via email | Falls back to passcode | BIP-39 recovery phrase you set during setup |
People forget passwords. They rarely forget a repeated hand movement. Pattern unlock uses the same kind of motor memory. After a few uses, your hand draws the pattern faster than your mind can describe it. Patterns drawn from muscle memory are difficult to dictate, difficult to write down, and difficult for someone watching to copy at speed.
Every extra second on the unlock screen is a second when someone else might observe you. You are looking at the phone, the phone is awake, the contents are within tap distance, and other people may be able to see the screen. An unlock method that is simple enough to become part of your daily routine is more secure in practice than a twelve-character password that requires several extra steps to retrieve.
Most apps separate the unlock step from the encryption. You type a password, the app confirms that it matches, then loads files that were already readable on disk. In ArkWarden, the pattern derives the encryption key. There is no readable file state before the pattern is drawn.
None of this is required to use ArkWarden, but if you want to verify our claims, this explains the system after the gesture. See the full security overview.
What ArkWarden requires of your pattern
| Rule | Value | Why |
|---|---|---|
| Minimum dots | 6 | Filters out very short patterns like a single line or a small L shape. |
| Minimum direction changes | 2 | Prevents straight-line patterns and the predictable corner-to-corner shapes that dominate published lock-pattern datasets. |
| Grid size | 5x5 | Billions of possible patterns, significantly more than a 6-digit iPhone passcode. The pattern space grows enormously with each added row and column. |
Patterns that do not meet the minimums are rejected at setup with a clear hint. You cannot accidentally end up with a weak pattern in ArkWarden, because the app will not accept one.
The unlock screen collects your dot sequence, loads the per-vault salt from the iOS Keychain (encrypted at rest by the Secure Enclave on every supported iPhone), runs PBKDF2 to produce a 256-bit candidate key, then attempts to unwrap the master key using that candidate. If the unwrap succeeds, the master key enters memory and the vault opens. If it fails, the grid clears for another try. A second factor check runs after a successful unwrap, if you have one enabled.
A subtle point worth noting: the hash check is a fast pre-check, not the final authority. ArkWarden compares a hash of your derived key against a stored hash to decide quickly whether to proceed. But the vault only opens if that same candidate key successfully unwraps the master key via authenticated decryption. The hash speeds up the common case; the unwrap is what actually decides.
The pattern is the first factor. It produces the encryption key. The second factor, if you enable it, is a separate check placed after the unwrap. You can choose Face ID or Touch ID (biometric data never leaves your device), a 6-digit PIN stored in the Keychain, or a physical YubiKey over NFC. You can also use no second factor at all. ArkWarden does not pressure you into a particular choice.
ArkWarden lets you set a second, completely separate pattern called Wing. Wing opens a different vault with its own name, icon, color, and files. The two patterns live on the same lock screen. Nobody looking at your phone can tell which pattern opens which vault, or that a second pattern even exists. Wing is designed for the situation where you are asked to unlock your vault by someone you cannot refuse.
Drawing a pattern is faster than typing a password, harder to copy than a PIN, and the only thing that keeps your files encrypted. ArkWarden derives a 256-bit encryption key from that pattern every time you use it.
