Strong encryption has an uncomfortable side: if the only key is something you remember, forgetting it means losing everything. Many photo vault apps avoid that problem by keeping a master key on their servers or tying your vault to an email reset. That works, but it also means someone other than you can open your vault.
Sanctum takes the other path. There is no account and no company-held key. Instead, every vault gets its own recovery code: a second, independent key that you keep.
What the recovery code is
When you create a vault, Sanctum generates 256 random bits with Apple’s CryptoKit and shows them to you as 64 characters, split into eight groups of eight:
- Characters are 0–9 and A–F, so there is nothing to confuse like O and 0 or I and l.
- Spaces and dashes are ignored when you type it back, and case doesn’t matter.
- Setup asks you to confirm you have saved it before the vault is ready.
256 random bits is the same strength as the AES-256 key it protects. Trying every possible code is not a matter of time or computing power; it is physically out of reach.
How it opens your vault
Your photos are encrypted with a random 256-bit vault key using AES-256-GCM. That vault key is stored twice, each time wrapped by a different key:
- The pattern wrapper, which needs your pattern and a secret in this iPhone’s Keychain. This is what you use every day.
- The recovery wrapper, which needs only your recovery code. Sanctum derives a key from the code with HKDF-SHA256 and a random salt unique to the vault.
The two wrappers are independent. The recovery code doesn’t reveal your pattern, and your pattern doesn’t reveal the recovery code. Your photos are never re-encrypted when you use one or the other, only unwrapped. Read how the first wrapper works in pattern encryption.
Because the recovery wrapper doesn’t depend on the device secret, it keeps working when the pattern can’t: after a Keychain reset, on a new iPhone, or after a duress vault has switched your other patterns off.
When you will need it
You forgot your pattern
Choose to use your recovery code on the lock screen. Sanctum tries the code against your vaults, opens the one it belongs to, and lets you set a new pattern. A 256-bit code can’t be guessed, so the escalating delay that protects patterns doesn’t apply to it.
You moved to a new iPhone
Sanctum’s Private Backup saves your vault, already encrypted on your iPhone, to your own iCloud Drive. It is on by default for your first vault. On a new iPhone, choose Restore a backup, pick the file from iCloud Drive › Sanctum and enter the recovery code. Apple stores only an encrypted file it cannot read, and we never receive it.
A duress vault was opened
If you set up a duress vault and someone forces you to open it, Sanctum silently switches off your other vaults’ patterns on that iPhone. Nothing is deleted. Later, each vault opens again with its recovery code, and you choose new patterns. More on this in hidden vaults.
Recovery code vs a recovery phrase
Some apps use a list of words instead. Words are easier to read aloud; a random code is easier to verify and carries exactly 256 bits with no word list to depend on. Either works if it is truly random and long enough. What matters more is the design around it: whether the code opens your vault directly, or only a separate wrapper you can replace, and whether anyone else holds a copy. With Sanctum, only you do.
How to store it safely
- Write it down on paper and keep it with other important documents.
- Or save it in a password manager you already trust, protected by its own strong password.
- Don’t screenshot it into Photos. Your camera roll is the first place someone looks, and it may sync to other devices.
- Don’t keep it only on the same iPhone. If the phone is lost, the code should not be lost with it.
- One code per vault. If you have several vaults, label your notes in a way only you understand. A note titled “hidden vault” defeats the point.
The trade-off, stated plainly
If you lose both your pattern and your recovery code, the vault cannot be opened, by you, by us or by anyone else. We can’t reset it, and there is no support override. That is not a limitation we plan to remove; it is the guarantee that makes Sanctum private.
See the complete design in Sanctum’s security approach, or get help on the support page.