Security
Security, in full
Everything Oorvel does to protect your photos, every choice behind it, and the limits we will not hide. If a claim here is not in the code, it is a bug. Tell us.
The promise, stated narrowly
Your photos are encrypted on your iPhone with a key derived from six words only you know. The app has no network permission, no account, no analytics and no server. Nothing about you or your files leaves the phone unless you export it.
Privacy label: Data Not Collected. Network permission: none.
Who we defend against
- Someone who picks up your unlocked phone and opens Photos. Your vault is not in Photos.
- Someone who copies your phone's storage or backups. They get ciphertext, and a passphrase they must guess.
- Someone who demands you open the vault. The decoy gives them a vault to look at.
- Us. We cannot read, sell, leak or hand over what we never receive.
The cryptography
| Cipher | XChaCha20-Poly1305: authenticated encryption, so tampered files fail to open instead of opening wrong. |
| Key derivation | Argon2id, 256 MiB per derivation (128 MiB on older devices that cannot spare it). |
| Passphrase | 6 words chosen at random from a 7,776-word list: 77.5 bits. |
| Core | Written in Rust, shared by the app and the export format. |
| Network | None. The app does not request network access. |
Why six random words
A passphrase you choose yourself is shaped by what people find memorable, and attackers know those shapes. Six words picked by a random draw have no shape. Each word adds about 12.9 bits; six of them give 77.5.
That is 277.5 possibilities. At a thousand Argon2id guesses a second, trying every one takes 6.8 trillion years: about 491 times the age of the universe. Holding a thousand guesses in flight at once means 250 GiB of memory, all the time.
Why not a pattern or a PIN
A four-digit PIN has 10,000 possibilities. The common drawn patterns have far fewer than their grid suggests, and they can be read from a smudge on the screen. Short secrets need a server or a secure chip to slow guessing down. Oorvel has no server, so the secret itself has to be strong.
Pieces for people you trust
Your six words can be cut into pieces and handed to people you trust, in person. Some of the pieces together put the words back; fewer show nothing at all. The split is Shamir secret sharing, done on your phone, and the phone keeps no piece afterwards.
Keep a way back in
You keep using your six words. If you ever lose them, any 2 of your 3 people can bring them back. The honest part: those 2 people together could also open your vault without you.
No way back in
Files are sealed under new words you never see, then removed from the phone. Opening them takes 3 of 5 people and the sealed file. Nobody can make you open it, and you cannot open it alone either.
Each piece is shown as a code, in person or printed, never sent. A piece has a checksum, so a typo is caught before anything is combined. What to do if someone gives you a piece.
Limits we disclose
The iOS photo picker stages a copy
When you import, iOS hands Oorvel a copy of each photo. The original stays in your library until you delete it, and deleted photos sit in Recently Deleted for 30 days unless you empty it. Importing is not hiding until you finish both steps.
There is no recovery
Oorvel has no server and no account, so there is no reset link and no support desk that can let you back in. If you lose your six words and your sealed export, your photos are gone. That is the cost of a vault with no key but yours.
An open vault is open
Encryption protects files at rest. While the vault is unlocked, anyone holding your phone sees what you see.
A compromised phone is out of scope
If your iPhone runs malware with screen or memory access, no app on it can keep a secret. Oorvel assumes iOS itself is intact.
Read it and check it
- Source code: published when the repository opens at launch.
- How to verify a build: open source.
- Found a flaw? Write to security@oorvel.com. We reply within 48 hours and credit you when it is fixed.
Questions
Can Oorvel see my photos?
No. There is no Oorvel server, no account and no network permission. Your photos are encrypted on your phone and never leave it unless you export them yourself.
What happens if I forget my six words?
Your vault cannot be opened, by you or by us. There is no recovery, because a recovery path is also a way in for someone else. Keep your words, and keep a sealed export.
Why Argon2id and not PBKDF2?
PBKDF2 costs time but almost no memory, so specialised hardware can run billions of guesses cheaply. Argon2id makes every guess hold 256 MiB of memory, which is what makes large-scale guessing expensive.