Encryption: how Backroom protects your files
AES-256-GCM on each file, a random key for each vault and a slow key derivation for your pattern. The design in plain terms, including what it leaves exposed.
Each file is encrypted with AES-256-GCM. Each vault has its own random 256-bit key, and your pattern or recovery phrase unlocks that key. Everything stays on your iPhone. The code has not had an outside review, and this page lists the design's known limits, so you can judge whether it fits your situation.
We would rather tell you how this works than ask you to trust a padlock icon.
The design
Your files. Each file is split into 1 MiB chunks and encrypted with AES-256-GCM, using a key derived for that file. Tampering, truncation or reordering makes it fail to open.
Vault keys. Each vault has a random 256-bit master key that is created on your iPhone.
Your pattern. It goes through PBKDF2-HMAC-SHA512 at 1,000,000 iterations, with a 32-byte salt held in the Keychain on this device only. HKDF then splits the result into a key that unlocks the vault and a file name. There is no list of vaults to read, just files with unrelated names.
Your phrase. 128 random bits go through 300,000 PBKDF2 iterations, with no device salt, so the phrase can work on a phone restored from a backup.
Notes and details. Note text and item records use the same keys and are padded to hide their exact lengths.
What this protects against
- Someone copying the app’s files without your device’s salt, such as from a backup
- Someone opening the app on your unlocked phone, who reaches a pattern screen
What it does not protect against
- A full extraction of an unlocked-since-boot phone. A forensic tool may also get the Keychain salt, and could then guess patterns offline. There is no Secure Enclave binding.
- An estimate of how much you store. Vault counts, item counts and file sizes can be inferred from storage.
- Moments outside the vault. Imports pass through a temporary file. Video playback and Save a copy write a temporary unencrypted file, removed on close, on lock and on launch.
- Originals you left behind. Photos stay in Recently Deleted for about 30 days, and files in Files stay until you remove them.
- Screenshots and screen recording. Backroom does not block them.
- The keyboard. iOS may learn words typed in notes, as autocorrect stays on there.
- Malware or someone watching you. A compromised phone can see what you see.
Who has checked it
The authors wrote the tests, which cover the core encryption and crash recovery. No independent reviewer has checked it so far.
Frequently asked questions
Has Backroom been audited?
No. No outside review has been completed, and the source code is unpublished.
Is Backroom protected against quantum computers?
Backroom makes no such claim. See our guide on quantum computers and iPhone encryption for the general picture.
Is my data encrypted in backups?
Yes. Vault files are in device backups in the same encrypted form. Someone with a backup alone would have to attack your 12-word phrase, unless they also have your device's salt.