Encrypted vault for Android

The pattern is the key.

Photos, videos and documents, encrypted on your phone and opened by a pattern on 25 dots. Built for the moment someone makes you unlock it.

Get it on Google Play Android 11+ · paid · no ads · no network

How it is hardened

Network: No INTERNET permission, so the kernel refuses every socket. A build that adds it fails. No analytics, crash reports or account.
Key: Argon2id at 128 MiB, 3 passes, 4 lanes, then HMAC-SHA256 with a key that never leaves StrongBox.
Files: AES-256-GCM with a random key per file. Random 128-bit names, sizes padded to fixed steps.
Vault list: None. Unlock tries every header, so an unknown pattern opens an empty vault after the same 1,000 ms.
Unlock: Pattern only, at least 6 of 25 dots, common shapes refused. No fingerprint, no face.
Screen: FLAG_SECURE on every window: no screenshots, recordings, casts or recents thumbnail.
Permissions: None at install. Import uses the photo picker or share sheet. The camera is asked at first use.
Originals: Optional deletion with createDeleteRequest(): immediate, no 30-day trash.
Disk: App-private storage only. No plaintext temp files, no thumbnail cache, Android cloud backup off.
Memory: Screen off locks the vault and wipes its keys.
Backup: One encrypted file you place with the system picker, opened by a random 24-word phrase.
Proof: Verify prints the permissions Android holds for the app. Release builds are reproducible.

No account, no reset, no support desk. Nobody can recover it, including us.

Remember the pattern. It is stored nowhere.
Make the backup and keep the 24 words on paper. Without both, a lost phone or a factory reset ends the vault.
Back up again after adding files. A backup is a snapshot.

Paid on Google Play. The APK is the whole product: no account, no trial, no in-app store.

Get it on Google Play app.cachette · Android 11+