How secure is ArkWarden?
The full answer, in one place.
This page collects every security claim ArkWarden makes, the published standard that supports each one, and the things ArkWarden does not protect against. If you are reviewing ArkWarden for a publication, for a team, or for your own decision, this is the page to read. Each claim links to the feature page that explains it in full.
Bit master key,
encrypting your files.
Servers, accounts,
or copies of your key.
PBKDF2 iterations
on every unlock.
Secure Enclave key
for pattern unlock.
What ArkWarden protects, and how.
ArkWarden encrypts every vault file on your iPhone with a random 256-bit master key. Current pattern unlock combines your pattern with a non-exportable Secure Enclave key, so copied vault data alone cannot complete unlock on another device. There is no ArkWarden account or ArkWarden server, and ArkWarden never receives the key that opens your vault. If you forget your pattern, a recovery phrase that only you hold can restore access. A second pattern can open a separate Wing vault. ArkWarden shows the vault opened by the pattern you enter, with no Wing badge or status on the vault screen.
Everything below is a more precise version of that paragraph. The encryption that protects your files is open source, so you can read the code yourself.
Your pattern and your phone unlock the key
Your files are encrypted, not hidden. Pattern unlock uses your pattern and your iPhone’s Secure Enclave to unlock the master key.
Nothing leaves the device unencrypted
There is no account and no server to breach. Even if you enable iCloud Backup, neither we nor Apple have your encryption key.
The limits are stated clearly
ArkWarden explains what it does not protect against. That list appears in full further down this page.
What we say, what supports it,
and where to verify it.
Each row is a claim ArkWarden makes, the established standard or mechanism that supports it, and the page that explains it in detail.
| Claim | How it works | Standard | Read more |
|---|---|---|---|
| Your files are encrypted, not just hidden | Each file is encrypted individually with authenticated encryption before it is written to the device | AES-256-GCM | Encryption |
| Your pattern helps unlock the master key | The pattern runs through PBKDF2 with a per-vault salt, then combines with a Secure Enclave secret from your iPhone | PBKDF2, NIST SP 800-132, 600,000 iterations; Apple Secure Enclave | Encryption, Pattern |
| Copied vault data cannot be unlocked on another device | Current pattern unlock needs a non-exportable Secure Enclave key from your iPhone. That key cannot be copied or moved. | Apple Secure Enclave, device-bound key storage | Encryption, Pattern |
| The vault index is protected too | Category names, file titles, and ordering are encrypted with their own authenticated cipher | ChaCha20-Poly1305 | Encryption |
| A drawn pattern can be long and difficult to guess | New patterns use at least six different dots and two direction changes on a 5x5 grid. Every added dot increases the possible sequences. | Pattern entropy on a 5x5 grid | Pattern |
| You can add a second check | After the pattern, an optional second factor decides whether the vault is shown | Face ID and Touch ID via the Secure Enclave, or FIDO2 over NFC for YubiKey | Two-factor |
| You can recover a forgotten pattern | A recovery phrase uses a separate method to open the same random master key | BIP-39, 12 or 24 words | Recovery phrase |
| There is no ArkWarden account and no ArkWarden server | The app stores and unlocks the vault on your device. Optional backup goes to your own iCloud or an exported file. | On-device architecture | On-device privacy |
| Protected key material stays device-bound | Encrypted keys and salts are stored in the iOS Keychain with device-only protection; pattern unlock also needs the Secure Enclave key on that iPhone | iOS Keychain, ThisDeviceOnly storage; Apple Secure Enclave | On-device privacy |
| You have a second vault for forced-unlock situations | A second pattern opens a separate vault with its own files. ArkWarden shows no badge or status that identifies which vault is open. | Parallel-vault design | Wing |
| ArkWarden hides the screens it controls from screenshots and recordings | ArkWarden's own screens are hidden from captures. | iOS screen-capture protection | Pattern |
What ArkWarden does not protect against.
No security tool protects against everything. These are the real limits of ArkWarden. Read them before you decide whether it fits your situation.
The limits, stated plainly
- Someone watching you draw your pattern. A person looking over your shoulder, or a camera pointed at your screen, can learn your pattern. Draw in private when you can.
- Losing both your pattern and your recovery phrase. If both are gone, the vault cannot be recovered by anyone, including us. That is the point. Anything we could use to recover it, someone else could use against you.
- Your device lock itself. ArkWarden protects the files inside the vault. It does not replace your iPhone passcode. Lock your device as well.
- Restoring to a new iPhone without your recovery phrase. Secure Enclave protection is tied to your current iPhone. Your recovery phrase is what lets you restore your vault on a different device.
- The Wing vault under a determined search. Wing has no second factor, and someone who learns the Wing pattern can open it. Store believable, everyday files in Wing, and keep your most sensitive files in the main vault, which your second factor protects.
Nine parts, one design.
Each pillar has its own page with step-by-step detail, a comparison against the alternatives, and a technical section for verification.
Encryption
How every file is encrypted with authenticated encryption before it is written to disk, using a random 256-bit master key.
No. 02Pattern unlock
The gesture that helps unlock the master key. A 5x5 grid, Secure Enclave protection, and device-bound guessing resistance.
No. 03Two-factor authentication
An optional second check after the pattern. Face ID or Touch ID, a 6-digit PIN, or a YubiKey over NFC. You choose one, or none.
No. 04Wing
A second real vault with its own pattern, name, and files. When someone asks you to open your vault, you can open Wing instead.
No. 05Recovery phrase
The 12 or 24 words that restore access if you forget your pattern. Generated on device, shown once, held only by you.
No. 06On-device privacy
No account, no server. Pattern unlock runs on your device, and ArkWarden never receives the key that opens your vault.
No. 07Backup & Restore
Back up your vault to iCloud or export it as a file. Every backup is encrypted with your recovery phrase before it leaves your phone. Off by default.
No. 08Folders and categories
Create folders within each category. Drag files into folders or import them directly, and keep your vault organized as it grows.
No. 09Intruder Detection
Optional and off by default. After 3, 5, or 10 wrong pattern attempts, ArkWarden takes an encrypted front-camera photo you can review in Settings.
The standards this design rests on.
The claims on this page are built on published standards from recognized bodies. Each link points to the primary source.
- NIST SP 800-132. Recommendation for Password-Based Key Derivation. National Institute of Standards and Technology. nvlpubs.nist.gov
- NIST SP 800-38D. Recommendation for Block Cipher Modes of Operation: GCM. National Institute of Standards and Technology. csrc.nist.gov
- FIPS 197. Advanced Encryption Standard (AES). National Institute of Standards and Technology. csrc.nist.gov
- RFC 7539. ChaCha20 and Poly1305 for IETF Protocols. Internet Engineering Task Force. datatracker.ietf.org
- BIP-39. Mnemonic wordlist standard for generating deterministic keys. bips.dev/39
- FIDO2. Standard for hardware-backed authentication, used by ArkWarden with YubiKey over NFC. fidoalliance.org
- OWASP Password Storage Cheat Sheet. PBKDF2 iteration count recommendations. Open Web Application Security Project. cheatsheetseries.owasp.org
- Apple Platform Security: Secure Enclave. Hardware-backed key storage on Apple devices. Apple. support.apple.com
Situations these protections are built for.
What people usually ask next.
How does ArkWarden protect my private files?
Are my files encrypted, or only hidden?
Can ArkWarden or Apple access my vault?
What happens if someone copies my encrypted vault data?
Do I need an account or internet to unlock?
What happens if I forget my pattern?
Can I add Face ID, a PIN, or a YubiKey?
What is Wing?
Can someone screenshot the unlock screen or my files?
What standards does ArkWarden use?
What does ArkWarden not protect against?
Security you can read
in full and verify yourself.
No account, no server, no copy of your key. Every claim on this page links to the code, standard, or mechanism behind it.
Point your camera at the code.
