Vaultumi

How Face ID protects a photo vault on iPhone

By Vaultumi. Published .

Face ID feels like magic, so it is easy to assume it does more than it does. Here is what actually happens when a vault app unlocks with your face, using Vaultumi as the worked example.

Face ID releases a key; it is not the lock

When you look at your iPhone, iOS compares your face with the data it keeps on the device. If it matches, iOS allows one thing: using a secret that was stored behind that check. The app never receives a picture of your face, only the system’s answer.

In Vaultumi the vault’s master key is wrapped (encrypted) by your PIN, by the recovery code and, if you enable it, by a random key held in the iOS Keychain behind the Face ID prompt. A correct Face ID check lets iOS hand that random key to the app, which uses it to unwrap the master key. Vaultumi only gets a yes or no from iOS, and it never sees or stores your face data.

Your PIN always keeps working

Face ID is a convenience on top of the PIN, never a replacement. Turning it on or off does not change how the PIN protects the vault. If Face ID fails, if you cancel the prompt, or if the lights are bad, you type your PIN. A cancelled Face ID prompt is not counted as a wrong PIN attempt.

If you wear a mask or the sensor is dirty, you are not locked out. You can unlock with the PIN at any time, so keep it memorised and keep your recovery code on paper.

What happens when faces change

The Keychain key is tied to the faces enrolled on your iPhone when you switched Face ID on. If you add or remove a face, or the device passcode is removed, iOS makes that key unusable. Vaultumi tells you Face ID has changed, your PIN still works, and you can enable Face ID again in settings.

This is a good property. If someone who knows your device passcode adds their own face to your iPhone, that will not give them a way into your vault through Face ID, because the key your face was protecting is invalidated the moment the enrolment changes.

Face ID opens the main vault only

Premium includes a decoy vault with its own PIN. Face ID unlocks only the main vault, never the decoy. The decoy is meant for casual situations; a technical examination of the phone’s storage can reveal that a second vault exists, so do not treat it as a hidden volume.

Setting it up

  1. Create your vault with a 6-digit PIN and save the recovery code you are shown once.
  2. Turn on Face ID when you are offered it, or later in the app’s settings. iOS asks for permission the first time.
  3. Choose the auto-lock delay. The vault locks when you leave the app, immediately or after a delay you pick, and the app switcher shows a cover instead of your photos.

Next time you open the app, look at your phone and the vault opens. No account, no sign-in and nothing sent to a server.

What Face ID does not do

  • It does not make the data stronger. Both unlock paths open the same master key. Your files are encrypted with AES-256-GCM either way.
  • It cannot tell willing from unwilling. Someone who holds the phone in front of your face, or forces you to unlock it, is outside what any lock can handle.
  • It does not help on a compromised phone. Malware or a jailbreak can read what is in memory while the vault is open.
  • It does not stop screenshots. iOS lets no app block them, and they land in your Photos library, outside the vault.

A note on verification

The project’s own notes say real Face ID behaviour still needs checking on physical devices before release, and that Vaultumi has not been independently reviewed or audited. That is listed under known limitations on the security page, together with the rest of the design. We would rather you hear it from us.

If Face ID stops working

Face ID is switched off for the app if you change your enrolled faces or remove your passcode. Unlock with your PIN, then enable Face ID again in the app’s settings. If it simply fails now and then, try again, or use the PIN. A cancelled Face ID prompt does not count as a wrong PIN, and nothing here deletes anything: the app never erases data because of failed unlock attempts.

Should you turn it on?

For most people, yes. It makes you more likely to keep the vault locked and to use a proper PIN, since you rarely type it. If you worry about being made to unlock your phone, you can leave Face ID off and use only the PIN. Either way, a recovery code and a tested backup matter more than the unlock method. See how to back up a private photo vault.

All guides