Encryption you do not have to manage
Coming to the App Store. See what version 1.0 includes.
Free for iPhone. Pro is optional.
The short answer
Yes. Everything you store in a StrongRoom Vault is encrypted with AES-256-GCM, using the encryption built into iOS. You do not choose settings or press an encrypt button; adding an item is encrypting it.
What is encrypted
The photo, video or file itself, its thumbnail, and the index that lists your items and folders. Folder names, item names and counts are inside that encrypted index, so they are unreadable without the key. File names on disk are random.
Three layers of keys
The key that encrypts your items is a random 256-bit Master Key. The Master Key is never stored on its own. It is wrapped by a key made from your pattern or passphrase, stretched so each guess costs real time, and combined with a Device Secret from the Secure Enclave. Change your credential and only the wrapper changes.
A key for every item
Each item has its own key, kept in the encrypted index. When you delete an item the key is destroyed, and the stored blob can no longer be read, even though the bytes may sit on flash for a while. This is called crypto-erase.
Tied to this iPhone
The Device Secret is derived inside the Secure Enclave from a key that is never exported. Someone who copies the app's files to another computer gets ciphertext and no way to get the missing secret. StrongRoom also marks its data as excluded from iCloud and computer backups, and uses iOS file protection so files are unreadable while the phone is locked.
What encryption does not do
It does not protect an unlocked Vault from someone looking at your screen. It does not protect against a phone that already has spyware on it. It does not protect a file once you export or share it in the clear. A short, honest list is on the limits page.
Frequently asked questions
Is StrongRoom really encrypted?
Yes: AES-256-GCM for items, thumbnails and the index, with a separate key per item.
Does StrongRoom use the Secure Enclave?
It uses a Secure Enclave key to derive a secret that ties the data to your phone. The bulk encryption of files runs in the app, using Apple's CryptoKit; the Secure Enclave does not encrypt photos directly.
Can StrongRoom or Apple read my files?
We hold no keys and receive no data. Apple does not receive your Vault.
What happens when I delete an item?
Its key is destroyed, so the stored data can no longer be decrypted.
Is it a special grade of encryption?
We do not use grade labels; they mean nothing. We use AES-256-GCM, which is a published standard.