This page collects every security claim ArkWarden makes, the published standard that supports each one, and the things ArkWarden does not protect against. If you are reviewing ArkWarden for a publication, for a team, or for your own decision, this is the page to read. Each claim links to the feature page that explains it in full.
Bit AES key,
derived from your pattern.
Servers, accounts,
or copies of your key.
PBKDF2 iterations
on every unlock.
ArkWarden encrypts the files you put in your vault, on your device, using a key derived from the pattern you draw. The key is never stored. There is no account and no ArkWarden server, and your key never leaves your iPhone. If you forget your pattern, a recovery phrase that only you hold can restore access. If you can be forced to unlock, a second pattern opens a separate vault, and nothing ArkWarden shows while that vault is open reveals the other one.
Everything below is a more precise version of that paragraph. The encryption that protects your files is open source, so you can read the code yourself.
Your files are encrypted, not hidden. Without the right pattern, the data stored on the device cannot be read.
There is no account and no server to breach. Even if you enable iCloud Backup, neither we nor Apple have your encryption key.
ArkWarden explains what it does not protect against. That list appears in full further down this page.
Each row is a claim ArkWarden makes, the established standard or mechanism that supports it, and the page that explains it in detail.
| Claim | How it works | Standard | Read more |
|---|---|---|---|
| Your files are encrypted, not just hidden | Each file is encrypted individually with authenticated encryption before it is written to the device | AES-256-GCM | Encryption |
| Your pattern produces the key | The pattern runs through a slow key derivation function with a per-vault salt to produce a 256-bit key | PBKDF2, NIST SP 800-132, 600,000 iterations | Encryption, Pattern |
| The vault index is protected too | Category names, file titles, and ordering are encrypted with their own authenticated cipher | ChaCha20-Poly1305 | Encryption |
| A drawn pattern is a strong secret | A 5x5 grid with a six-dot minimum and required direction changes produces billions of possible patterns | Pattern entropy on a 5x5 grid | Pattern |
| You can add a second check | After the pattern, an optional second factor decides whether the vault is shown | Face ID and Touch ID via the Secure Enclave, or FIDO2 / WebAuthn for YubiKey | Two-factor |
| You can recover a forgotten pattern | A recovery phrase reaches the same master key through the same derivation, with no server involved | BIP-39, 12 or 24 words | Recovery phrase |
| There is no account and no server | The app holds everything it needs on the device. No sign-in, no server, no telemetry on file contents | On-device architecture | On-device privacy |
| Keys are encrypted at rest by the Secure Enclave | Encrypted keys and the salt are stored in the iOS Keychain, encrypted at rest by the Secure Enclave and marked device-only | iOS Keychain, encrypted at rest by the Secure Enclave | On-device privacy |
| You have a second vault for forced-unlock situations | A second pattern opens a separate vault with its own files, and nothing the app shows reveals the other vault | Parallel-vault design | Wing |
| Screens cannot be captured | Screenshots and screen recordings are blocked across the entire app, enforced by iOS | iOS screen-capture protection | Pattern |
No security tool protects against everything. These are the real limits of ArkWarden. Read them before you decide whether it fits your situation.
Each pillar has its own page with step-by-step detail, a comparison against the alternatives, and a technical section for verification.
How the pattern you draw derives a 256-bit AES key, and how every file is encrypted with authenticated encryption before it is written to disk.
No. 02The gesture that produces the key. A 5x5 grid, a six-dot minimum, and required direction changes give billions of possible patterns.
No. 03An optional second check after the pattern. Face ID or Touch ID, a 6-digit PIN, or a YubiKey over NFC. You choose one, or none.
No. 04A second real vault with its own pattern, name, and files. When someone asks you to open your vault, you can open Wing instead.
No. 05The 12 or 24 words that restore access if you forget your pattern. Generated on device, shown once, held only by you.
No. 06No account, no server. Your keys and your pattern stay on the device.
No. 07Back up your vault to iCloud or export it as a file. Every backup is encrypted with your recovery phrase before it leaves your phone. Off by default.
No. 08Create folders within each category. Drag files into folders or import them directly, and keep your vault organized as it grows.
The claims on this page are built on published standards from recognized bodies. Each link points to the primary source.
No account, no server, no copy of your key. Every claim on this page links to the standard that supports it and the page that explains it.
