Most photo locker apps work like a door with a lock painted on it. You type a PIN, the app compares it with a stored value, and then it shows files that were never encrypted in the first place. Anyone who copies the app’s folder, or finds a bug in the PIN screen, can see everything.

Sanctum works differently. Your pattern is not compared with anything. It is the raw material for an encryption key. Without the right pattern, or the vault’s recovery code, the key that decrypts your photos cannot be produced at all.

What counts as a pattern

You draw on a 5×5 grid of 25 dots, which gives you far more room than the 3×3 grid most people know from Android. The rules are simple:

If you swipe over a dot you haven’t used, it is added to the pattern, the same way Android’s pattern lock works. That means drawing through a dot and jumping over it give the same result, so your pattern depends only on the shape you draw, not on how fast you draw it.

Even counting only eight-dot patterns, a 5×5 grid allows billions of possible orderings. The whole 3×3 Android grid has 389,112. In practice, though, people draw letters, zigzags and corners, so Sanctum never relies on pattern length alone.

From pattern to key: the three layers

1. PBKDF2-HMAC-SHA512, 600,000 rounds

When you draw your pattern, Sanctum feeds the dot sequence into PBKDF2 with HMAC-SHA512, a random 32-byte salt unique to that vault, and 600,000 iterations. That is the work factor OWASP recommends for PBKDF2-HMAC-SHA512 at the time of writing. Each guess an attacker makes costs the same 600,000 rounds of hashing, which turns millions of guesses per second into a crawl.

The salt means two people who happen to draw the same shape still end up with unrelated keys, and precomputed tables are useless.

2. A secret that never leaves your iPhone

The result of PBKDF2 is then mixed, using HKDF-SHA256, with a random 256-bit secret stored in your iPhone’s Keychain as a this-device-only item. It is never synced to iCloud Keychain, never included in iPhone backups and never sent anywhere.

This is the layer that matters most against offline attacks. If someone copies Sanctum’s vault folder to a computer, they have the encrypted files and the salt, but not the device secret. Without it there is nothing to brute-force: every pattern they try produces the wrong key.

3. A random vault key, wrapped

Your pattern never encrypts your photos directly. When you create a vault, Sanctum generates a random 256-bit vault key. That key encrypts every photo, video, thumbnail, title and album with AES-256-GCM. The key derived from your pattern only wraps the vault key, also with AES-256-GCM.

This design has two practical benefits:

Because AES-GCM is authenticated encryption, a wrong pattern doesn’t produce garbage that the app has to interpret. The unwrap simply fails, and tampered files are detected instead of being shown.

On-device guessing is slowed down

Someone holding your unlocked iPhone could try patterns by hand. After a couple of wrong attempts, Sanctum adds a delay that grows with each failure: 2 seconds, then 4, 8, 16, 32, a minute, five minutes, and finally 15 minutes per attempt. A few hundred guesses would take days. The delay survives restarting the app, and changing the clock can’t extend it beyond one maximum delay, so you are never locked out for longer than that.

The recovery code is not held behind this delay. A 256-bit code can’t be guessed, so an owner who forgot their pattern is never stuck waiting.

How to choose a strong pattern

What pattern encryption does not protect

Being honest about limits is part of the design. Pattern encryption protects your vault when it is locked. It cannot protect you if someone watches you draw the pattern, if the vault is open on screen, or if your iPhone itself is compromised by malware. Photos you export or share out of Sanctum are outside its protection, and so are originals you leave in the Photos app after importing.

For the full design, including backups and sharing, read Sanctum’s security approach.