Vaultumi

How to choose a PIN, recovery code and backup passphrase for a photo vault

By Vaultumi. Published .

A photo vault does not rest on one password. It has three secrets with different jobs, and the one you type every day is the weakest by design. Knowing which is which tells you where to spend your effort.

How to choose a PIN, recovery code and backup passphrase for a photo vault

Key takeaways

  • The PIN is a convenience lock. The recovery code and the backup passphrase are the strong secrets.
  • Use a PIN you can remember and nobody can guess from your life: not a birthday, not your phone passcode, not a bank PIN.
  • Keep the recovery code on paper, away from the phone. Let the app generate your backup secret, or use several unrelated random words.
  • If you lose all of your secrets and have no backup, the photos cannot be recovered, by design.

Three secrets, three jobs

In Vaultumi the secrets are separate on purpose.

  • PIN. Six digits, used every day on this iPhone. It is not stored in readable form.
  • Recovery code. 32 letters and digits in eight groups, shown once when you create the vault. It opens the vault if you forget the PIN, and after a phone has been restored from a backup.
  • Backup passphrase. Protects a backup file, which can be opened on any iPhone with the app and needs only this passphrase.

Face ID is a convenience on top of the PIN, not a fourth secret. How it works is in the Face ID guide.

The PIN: memorable and not guessable

A six-digit PIN has a million possibilities. That is enough to stop a casual snooper, and it is not meant to stop a determined technical attacker. Vaultumi adds a wait of 30 seconds after five wrong attempts, growing to an hour, and it never erases anything. The PIN is also mixed with a secret kept only in this iPhone’s Keychain, which is in no backup. Still, if someone gets both the vault files and that device secret, for example from a compromised or forensically extracted phone, they could try all million PINs offline. Treat the PIN as a lock on the door, not as a safe.

Vaultumi rejects the most obvious choices, such as one repeated digit, simple ascending or descending runs and a short list of common patterns. Beyond that, avoid what someone close to you could guess:

  • birthdays, anniversaries and years;
  • the last digits of a phone number or an address;
  • your iPhone passcode or a card PIN, since both get typed in public and a leak of one would expose the others;
  • a pattern on the keypad, like a corner shape or a cross.

A good method is to pick six digits at random, for example from dice rolls or a random-number generator, and then use them daily until your fingers know them. Write them nowhere near the phone. Changing the PIN later is easy and does not touch your photos.

Cover the keypad when you enter it in public. Vaultumi cannot protect a PIN that someone watches you type, and Face ID helps there because the PIN is typed less often.

The recovery code: the one to protect

The recovery code is a 160-bit random value. Nobody can guess it, and Vaultumi does not store it, so it cannot show it to you again. Whoever has it can reset the PIN and open the vault, so treat it like a key to the house.

  • Write it on paper at the moment it is shown, and check the copy letter by letter.
  • Keep it away from the phone, in a drawer, a safe or a safe deposit box. Do not photograph it or save it in a note on the same iPhone.
  • Remember that a restored phone needs it. The device-bound part of the PIN protection is not in any backup, so after a restore the PIN will not work and the recovery code is the way in.
  • If you think someone saw it, make a new one in the app. The old code stops working.

If trusted people should be able to help, the free Legacy Kit splits a new recovery code into printed cards, any few of which rebuild it. It has no timer and releases nothing on its own, and it replaces your current code once you finish it. The guide to a forgotten PIN explains what happens when you need it.

The backup passphrase: length beats cleverness

A backup file is the one piece of your vault that can leave your phone, so its passphrase has to hold up against someone with unlimited time at home. A short or guessable one can be cracked by anyone who gets the file.

  • Let the app generate it. The generated secret is 160 random bits and is the recommended choice.
  • If you choose your own, Vaultumi requires at least 12 characters and turns down heavy repetition and trivially common phrases. That is a floor and not a guarantee.
  • Use random words. Five or six words picked at random, from a dice-based word list for example, beat one clever word with substitutions. Each randomly chosen word from a list of 7,776 adds about 13 bits.
  • Never reuse it. Do not use your Apple ID password, your email password or your PIN.

Keep the backup file and its passphrase in different places. If you lose the passphrase, nobody can open that backup, including the developer. If you can still open the vault itself, make a new backup with a new passphrase. The guide to backing up a vault shows how, including the safety check that proves the file opens.

Where to keep each one

SecretGood homeAvoid
PINYour memoryNotes, photos, messages
Recovery codePaper, offline, away from the phoneA note or photo on the same iPhone, cloud storage
Backup passphrasePaper, or a password manager you can open from another deviceThe same place as the backup file; anything that needs the iPhone itself

The aim is that no single loss or theft takes both a way in and what it opens. A thief holding your phone should not also find your recovery code.

Honest limits

  • No choice of PIN defends against malware, a jailbroken phone, someone watching you type or someone who forces you to unlock it.
  • If you lose the PIN and the recovery code and have no backup, the photos cannot be recovered. There is no back door, which is also why no one can reset your vault for you.
  • The decoy vault has its own PIN but no recovery code, so if you forget it, you can only delete it and start again.
  • Vaultumi’s key handling uses Apple’s cryptography frameworks plus its own scrypt code, and has not been independently audited. The security page says what is and is not protected.

A short setup routine

  1. Choose six random digits and use them daily.
  2. Write the recovery code on paper the moment it appears, and store it away from the phone.
  3. Make a backup with the generated secret, and store that secret apart from the file.
  4. Run the Backup safety check.
  5. Revisit all three once a year, or after any moment you think someone saw them.

Sources

Primary sources behind the statements about iOS and cryptography on this page. The linked pages are in English.

All guides