What is crypto-erase? Deleting data by destroying its key

By The StrongRoom team · Published 2026-10-30 · Updated 2026-10-30 · Last verified on iOS 26.x on 2026-10-30

Crypto-erase makes data unreadable by destroying the key that decrypts it, instead of overwriting the data itself. If every item is encrypted under its own key and that key is destroyed, the stored bytes are noise. On flash storage that is faster and more dependable than trying to overwrite. StrongRoom destroys an item's key when you delete the item.

Why deleting a file does not delete it

Ordinary deleting removes the entry that points to a file. The bytes can stay where they were until something else is written over them. Overwriting the file first can work where a write lands on the same place. Flash storage may spread writes around, so a write can land somewhere new and leave the old copy behind, and an app cannot see or control that.

The crypto-erase idea

If the data is stored encrypted, the data itself does not need to disappear. Only the key does.

1. Each piece of data is encrypted with its own key.
2. The key is stored somewhere small and under control.
3. To erase, destroy the key.
4. The leftover encrypted bytes can no longer be turned back into anything. They are the same as random noise.

This works because destroying a small thing reliably is much easier than finding every copy of a large thing. It only works if the key was never stored anywhere else, and if the data was encrypted from the start.

Apple does it for the whole phone

Apple's deployment documentation describes the same principle for erasing a device: it says that erasing "obliterates all the keys in effaceable storage", which makes user data cryptographically inaccessible. Apple's Data Protection documentation also says a new 256-bit key is created for every file on the data volume. That is Apple's layer, for the whole device. It is a device-level feature, not something an app can reach for one file.

How StrongRoom uses it

StrongRoom applies the idea in two places.

• Deleting an item. Each item is stored as an encrypted Object with its own Object Key, kept in the Vault's encrypted index. When you delete the item, StrongRoom destroys that key. The stored bytes may linger on flash for a while, but they cannot be decrypted. This is why the app does not rely on overwriting.
• A Duress Vault. Opening a Duress Vault destroys the keys of every other Vault on the phone, which erases them for good. See the guide on duress passwords. It is a Pro feature and has no undo.

This describes the design, not a promise about every case. No outside expert has checked it yet.

What crypto-erase does not cover

• Copies you made. An Export Package or Share Package you saved or sent still holds the item, and can still be opened with its phrase. A photo you left in your library stays there; the original is not touched unless you chose to delete it. When you import, StrongRoom asks every time whether to delete originals, and Photos keeps deleted items in Recently Deleted for 30 days.
• A key that was copied. Erasure only works if no other copy of the key exists. In StrongRoom, keys exist in memory only while a Vault is open, and the app does not claim a provable wipe of every transient copy.
• Screenshots and exports made while the item was open.

Is destroying a key the same as deleting a file?

For the purpose of reading the data, yes: nobody can read it afterward. For the purpose of the bytes still occupying space for a while, no. That is the trade, and for private data it is the right one.

Keep reading

• What is a duress password?
• Does a photo vault really encrypt your files?
• How StrongRoom encrypts, feature page
• Duress Vault feature page
• If I delete a photo vault app, do I lose my photos?
• What StrongRoom does not protect against

Frequently asked questions

Sources

• Erase Apple devices (Apple Support), checked on 2026-10-30.
• Data Protection overview (Apple Support), checked on 2026-10-30.