What is the iPhone Secure Enclave?
The Secure Enclave is a separate, isolated part of the iPhone's chip that holds keys the rest of the system cannot read out. StrongRoom uses one such key to make a secret that ties its data to your phone. The Secure Enclave does not encrypt your photos; the app does that, with keys that depend on this secret.
What Apple says it is
Apple's Platform Security documentation describes the Secure Enclave as a dedicated secure subsystem built into Apple's system on a chip. Points that matter for a non-engineer:
- It is isolated. It is separate from the main processor, so it is meant to stay protected even if the main processor's kernel is compromised.
- It has its own start-up code and memory. Apple says it has its own boot ROM and runs from a dedicated region of memory that is encrypted and authenticated.
- It holds a unique device key. Apple describes a per-device root key, unique to each device, that the Secure Enclave uses. Because Apple's file-system key hierarchy includes that device-unique key, storage moved to another device becomes unreadable.
- It supports Face ID and Touch ID data, and passcode protections. Apple says its keys protect device-specific secrets, including data tied to Face ID and Touch ID, and its secure storage underpins passcode-protected data.
Apple also says plainly that the Secure Enclave does not encrypt files directly. File encryption on the iPhone is done by a dedicated AES engine on the path between flash storage and memory.
What a key inside it is good for
An ordinary app key lives in the app's memory or files, where anything that can read those can copy it. A key made inside the Secure Enclave is meant to stay there: StrongRoom's Enclave Key is never exported, and software asks the Secure Enclave to use it rather than reading it. The key cannot be copied off the phone, even by the app that made it.
That is the property that matters: a secret that exists only on this one phone.
What StrongRoom uses it for
StrongRoom keeps one Secure Enclave key per install, an Enclave Key that is never exported. The app uses it to derive a Device Secret. That secret is mixed into the key that unwraps your Vault's Master Key, along with your pattern or passphrase. In plain terms:
- Your credential alone does not open the Vault.
- The Device Secret alone does not open the Vault.
- Someone who copies the app's files to a computer gets ciphertext and cannot make the Device Secret, so a copy of the files is useless elsewhere.
The photos, videos, files and index are encrypted by the app with AES-256-GCM, using the encryption built into iOS. Each item has its own key. The Secure Enclave is one input to the chain of keys, not the thing that encrypts your photos.
What it does not do
- It does not stop someone who has your unlocked phone and your credential. The Device Secret is available to the app on this phone.
- It does not slow guessing by itself. In StrongRoom that is the work of the slow key stretching and the Throttle.
- It does not protect an open Vault from someone looking at the screen.
- It cannot be restored. If the Enclave Key is lost, the Device Secret cannot be recreated, and the engine refuses to make a new one. That is why a Vault moves to a new iPhone through an Export Package opened with its Recovery Phrase, not by copying files.
Whether Apple's documentation permits a third party app to use particular Secure Enclave key types is outside what this page covers; we describe only how StrongRoom is built.
Keep reading
- What is AES-256?
- Does a photo vault really encrypt your files?
- How StrongRoom encrypts, feature page
- Export Package: moving a Vault to a new iPhone
- What StrongRoom does not protect against
Frequently asked questions
Does the Secure Enclave encrypt my photos?
No. Apple says the Secure Enclave does not encrypt files directly. In StrongRoom the app encrypts each item with AES-256-GCM.
What does StrongRoom use it for?
To make a Device Secret that is mixed into the key protecting your Vault, so copied files cannot be opened elsewhere.
Can I move my Vault to a new iPhone by copying files?
No. The Device Secret does not leave the old phone. Use an Export Package and the Recovery Phrase.
Is the Secure Enclave the same as Face ID?
No. Face ID data is one thing the Secure Enclave protects. StrongRoom has no Face ID unlock, so that no credential can be told apart from the others.
Sources
- The Secure Enclave (Apple Support), checked on 2026-10-30.