Glossary
- AES-256-GCM. A published standard for encrypting data with a 256-bit key that also detects tampering. StrongRoom uses it for every item, thumbnail and index.
- Attempt log. The last 20 times an unlock attempt opened nothing, as times only. It never records a successful attempt.
- Crypto-erase. Making data unreadable by destroying the key rather than overwriting the data. Deleting an item destroys its key.
- Credential. The pattern or passphrase that opens a Vault.
- Decoy Vault. An ordinary extra Vault (a Pro feature) you are willing to reveal under pressure. It has no destructive behaviour.
- Device Secret. A value made with the Secure Enclave that ties the app's data to this physical phone. Copied files are useless without it.
- Duress Vault. A Vault flagged so that opening it erases every other Vault on the phone. A Pro feature, because it needs a second Vault to erase.
- Empty Vault. What the app shows for a credential that opens nothing: a Vault with no items, looking like a real one that has none.
- Export Package. An encrypted file holding a whole Vault, which you save or send yourself. The Recovery Phrase decrypts it, and it is the only way to move a Vault to a new phone.
- Folder. A named place inside a Vault that holds items, one level deep. Folders exist only in the encrypted index.
- Index. A Vault's encrypted catalogue of its items and their keys.
- Item. A photo, video or file kept in a Vault.
- Master Key. The random 256-bit key of one Vault. It is never stored unwrapped.
- Object Key. The random key of one stored item. Destroying it erases that item.
- Recovery Phrase. Twelve words, shown once, that set a new credential on this phone and decrypt an Export Package. It is not a cryptocurrency seed.
- Recovery PIN. An optional 6 to 12 digit number that does what the phrase does on this phone and nothing more. Weaker than the phrase; never unlocks on the lock screen.
- Secure Enclave. A separate processor in the iPhone that keeps keys that never leave it.
- Slot. One of 16 fixed, identical-size encrypted records that hold Vaults. Always present, used or not.
- Throttle. The rule that slows unlock attempts: ten in five minutes run freely, then each waits twice as long, from 30 seconds to an hour.
- Vault. One slot together with its credential, its Master Key and the items it holds.
- Zero-knowledge. A design where the provider cannot read your data. For StrongRoom: we hold no keys and receive no data.
Words we avoid
"Password" for the credential, "backup" for the Export Package, bare "PIN", and grand security labels.