This page collects every security claim ArkWarden makes, the published standard that supports each one, and the things ArkWarden does not protect against. If you are reviewing ArkWarden for a publication, for a team, or for your own decision, this is the page to read. Each claim links to the feature page that explains it in full.
Bit master key,
encrypting your files.
Servers, accounts,
or copies of your key.
PBKDF2 iterations
on every unlock.
Secure Enclave key
for pattern unlock.
ArkWarden encrypts every vault file on your iPhone with a random 256-bit master key. Current pattern unlock combines your pattern with a non-exportable Secure Enclave key, so copied vault data alone cannot complete unlock on another device. There is no ArkWarden account or ArkWarden server, and ArkWarden never receives the key that opens your vault. If you forget your pattern, a recovery phrase that only you hold can restore access. A second pattern can open a separate Wing vault. ArkWarden shows the vault opened by the pattern you enter, with no Wing badge or status on the vault screen.
Everything below is a more precise version of that paragraph. The encryption that protects your files is open source, so you can read the code yourself.
Your files are encrypted, not hidden. Pattern unlock uses your pattern and your iPhone’s Secure Enclave to unlock the master key.
There is no account and no server to breach. Even if you enable iCloud Backup, neither we nor Apple have your encryption key.
ArkWarden explains what it does not protect against. That list appears in full further down this page.
Each row is a claim ArkWarden makes, the established standard or mechanism that supports it, and the page that explains it in detail.
| Claim | How it works | Standard | Read more |
|---|---|---|---|
| Your files are encrypted, not just hidden | Each file is encrypted individually with authenticated encryption before it is written to the device | AES-256-GCM | Encryption |
| Your pattern helps unlock the master key | The pattern runs through PBKDF2 with a per-vault salt, then combines with a Secure Enclave secret from your iPhone | PBKDF2, NIST SP 800-132, 600,000 iterations; Apple Secure Enclave | Encryption, Pattern |
| Copied vault data cannot be unlocked on another device | Current pattern unlock needs a non-exportable Secure Enclave key from your iPhone. That key cannot be copied or moved. | Apple Secure Enclave, device-bound key storage | Encryption, Pattern |
| The vault index is protected too | Category names, file titles, and ordering are encrypted with their own authenticated cipher | ChaCha20-Poly1305 | Encryption |
| A drawn pattern can be long and difficult to guess | New patterns use at least six different dots and two direction changes on a 5x5 grid. Every added dot increases the possible sequences. | Pattern entropy on a 5x5 grid | Pattern |
| You can add a second check | After the pattern, an optional second factor decides whether the vault is shown | Face ID and Touch ID via the Secure Enclave, or FIDO2 over NFC for YubiKey | Two-factor |
| You can recover a forgotten pattern | A recovery phrase uses a separate method to open the same random master key | BIP-39, 12 or 24 words | Recovery phrase |
| There is no ArkWarden account and no ArkWarden server | The app stores and unlocks the vault on your device. Optional backup goes to your own iCloud or an exported file. | On-device architecture | On-device privacy |
| Protected key material stays device-bound | Encrypted keys and salts are stored in the iOS Keychain with device-only protection; pattern unlock also needs the Secure Enclave key on that iPhone | iOS Keychain, ThisDeviceOnly storage; Apple Secure Enclave | On-device privacy |
| You have a second vault for forced-unlock situations | A second pattern opens a separate vault with its own files. ArkWarden shows no badge or status that identifies which vault is open. | Parallel-vault design | Wing |
| ArkWarden hides the screens it controls from screenshots and recordings | ArkWarden's own screens are hidden from captures. | iOS screen-capture protection | Pattern |
No security tool protects against everything. These are the real limits of ArkWarden. Read them before you decide whether it fits your situation.
Each pillar has its own page with step-by-step detail, a comparison against the alternatives, and a technical section for verification.
How every file is encrypted with authenticated encryption before it is written to disk, using a random 256-bit master key.
No. 02The gesture that helps unlock the master key. A 5x5 grid, Secure Enclave protection, and device-bound guessing resistance.
No. 03An optional second check after the pattern. Face ID or Touch ID, a 6-digit PIN, or a YubiKey over NFC. You choose one, or none.
No. 04A second real vault with its own pattern, name, and files. When someone asks you to open your vault, you can open Wing instead.
No. 05The 12 or 24 words that restore access if you forget your pattern. Generated on device, shown once, held only by you.
No. 06No account, no server. Pattern unlock runs on your device, and ArkWarden never receives the key that opens your vault.
No. 07Back up your vault to iCloud or export it as a file. Every backup is encrypted with your recovery phrase before it leaves your phone. Off by default.
No. 08Create folders within each category. Drag files into folders or import them directly, and keep your vault organized as it grows.
No. 09Optional and off by default. After 3, 5, or 10 wrong pattern attempts, ArkWarden takes an encrypted front-camera photo you can review in Settings.
The claims on this page are built on published standards from recognized bodies. Each link points to the primary source.
No account, no server, no copy of your key. Every claim on this page links to the code, standard, or mechanism behind it.
