# Encryption Alone Doesn't Stop a Password Guesser. Here's What Does.

Most encrypted vault apps ask for a password, run it through a slow hash, and call the file secure. A slow hash only raises the cost of each guess. If someone copies the encrypted file, they can run unlimited guesses on their own hardware: no rate limit, no lockout, just time and GPUs. ArkWarden's vault doesn't have that gap. Half of its unlock key lives inside the iPhone's Secure Enclave and can never be copied out, so copying the encrypted file gets an attacker nothing to attack. Here's how that actually works.

ArkWarden [https://arkwarden.app/](https://arkwarden.app/) is an encrypted vault for photos, videos, documents, and audio on iPhone. When I designed how it unlocks, I didn't want a password to be the only thing standing between a guess and the file.

A password strong enough to survive offline guessing is long. People reuse it, write it down, or pick something guessable instead. Typing a long password every time you want one photo creates a different problem: people weaken the password, or stop locking the app at all.

The master key is protected by two things at once: a pattern you draw, and a key that lives in the iPhone's Secure Enclave and cannot leave it.

## How unlock works

The master key is a random 256-bit key, created once when you set up the vault. It is not made from the pattern. The pattern helps unlock a locked copy of that key.

When you draw the pattern, ArkWarden runs it through PBKDF2-HMAC-SHA256, 600,000 times, with a salt unique to your vault. That slow step is the first half. Each wrong guess has to pay the same cost.

The second half comes from the Secure Enclave, a separate security chip in the iPhone. ArkWarden creates a key pair on that chip at setup. Its private key can never be copied off the hardware. Every unlock, ArkWarden asks the chip to compute a shared secret and uses that as the second input.

Leave either half out and the master key stays locked.

## Why not a stronger password?

If unlock depends only on a password, someone who copies the locked files can try guesses on other computers. PBKDF2 at 600,000 iterations makes each guess slow. It does not stop the attack, because everything needed for a guess is already in the copied data.

Pattern unlock also needs a Secure Enclave key, and that key can't be copied. So copied vault files aren't enough on another device: the second input never left the original iPhone, which means every attempt has to run on that exact phone.

On the phone, ArkWarden waits 15 minutes after 10 wrong patterns. At the shortest allowed pattern, 6 dots and 2 turns on a 5x5 grid, trying every possible pattern on the device would take roughly 568 years.

The chip is already required, so the pattern does not have to stand alone the way a password would. Six dots and two direction changes is the minimum.

Apple's Files app has no way to password-protect one folder. The closest option is locking the whole Files app with Face ID, Touch ID, or your passcode, the same unlock that opens the phone itself. I wrote about that here: https://arkwarden.app/guides/password-protect-folder-on-iphone

## What this costs

Pattern unlock is tied to that phone. A new iPhone cannot open the vault with the pattern alone. The old Secure Enclave key stayed on the old phone and cannot be moved.

That is what the recovery phrase is for. At setup, ArkWarden generates a 12 or 24 word BIP-39 phrase. It unlocks the same master key without the Secure Enclave. It has to work on any device, which is why ArkWarden tells people to write it down and keep it somewhere safe.

Draw the pattern to unlock the vault on this iPhone, day to day. Use the recovery phrase only when you set up a new iPhone or lose access to this one.

The key derivation and Secure Enclave handling described here is in ArkWarden's open source encryption core: https://github.com/ArkWardenApp/ArkWarden

ArkWarden is available on the App Store: https://apps.apple.com/app/id6777033926