Bunker encrypts every item in a vault on your device, before it is stored, backed up, synced or shared, using AES-256-GCM with keys that only your Pattern, your Passphrase or your Recovery Phrase can unlock. We have no account for you and no copy of your keys, so nobody at Bunker can open your vaults, and this page explains exactly how that works and where it stops.
The short version
- Encryption happens on your device. Photos, videos, documents, notes, their names, their thumbnails and the text read from your scans are encrypted before they are written to storage.
- Your Pattern is slow to guess. Each try runs Argon2id with 64 MiB of memory, mixed with a secret kept in your device’s Keychain. Someone holding only a copy of the app’s files can’t test guesses at all.
- Vaults are hidden. There is no list of vaults anywhere. Each vault’s records sit in a fixed-size file of random-looking bytes, and a Pattern that opens nothing looks and takes the same time as one that opens something.
- Backups and sync carry only ciphertext. iCloud stores encrypted packs. Apple can see how much you store, not what it is.
- Sharing and Legacy keys never reach a server. A share’s key lives in the link; a Legacy key is split across the Legacy Cards, and otherwise kept only inside your encrypted vault.
- We collect no content and need no account. No ads, no tracking across apps.
- It has limits, listed below.
What happens when you draw a Pattern
Each vault opens with a Pattern drawn on a 5 × 5 dial. It needs at least 6 dots and at least one change of direction, and the order counts: the same dots drawn in a different order are a different Pattern. Dots a straight line passes over are added for you. The app turns down common shapes (straight rows, the outer ring, letters like L, Z, U and C) and rates the rest Fair, Good or Strong; try the Pattern strength tool.
When you lift your finger, Bunker turns the Pattern into a key with Argon2id, a password-hashing function designed to be expensive to run many times:
| What is derived | Memory | Passes | Lanes | Secret mixed in |
|---|---|---|---|---|
| Pattern → vault key (on this device) | 64 MiB | 3 | 1 | Device pepper |
| Passphrase → its own key (on this device) | 64 MiB | 3 | 1 | Device pepper |
| Pattern → backup key (for iCloud) | 256 MiB | 3 | 1 | Cloud pepper |
| Recovery Phrase → recovery keys | 64 MiB | 3 | 1 | None (the phrase is random enough on its own) |
Guessing hardware is fast at arithmetic but must pay for memory on every guess, so the memory cost keeps each guess expensive. The app refuses settings below these floors, and vault records are bound to the file that stores them, so editing it makes records fail to open rather than easier to guess.
Why both. A random 6-dot Pattern with one turn has only about 13 bits of strength. What protects it is that a guess can only be tested with the right secrets, and each test costs a full Argon2id run. For more, add an optional Passphrase (at least 4 words or 16 characters).
The peppers. Two 32-byte random secrets are mixed into the Pattern’s key derivation:
- The device pepper lives in a Keychain item on your device, never in the app’s files. It moves to a new iPhone with Quick Start and with an encrypted Finder or Mac backup. When iCloud Keychain is on, a copy is also kept there, so restoring a new iPhone from an iCloud Backup still opens every vault by Pattern.
- The cloud pepper lives in iCloud Keychain, which Apple end-to-end encrypts. It is mixed into the key that opens your iCloud backup.
So someone holding only a copy of the app’s files, or only Bunker’s Encrypted Backup data in iCloud, can’t test a single Pattern guess.
Every device and every iCloud backup account also has its own 32-byte random salt, so precomputed guesses built for one person are useless against anyone else.
Unlock delays. After 4 misses in a row, the app waits 30 seconds after the 5th, 1 minute after the 6th, 5 minutes after the 7th, and 15 minutes after each from the 8th. Opening an existing vault resets the count; creating one doesn’t. Delays slow someone holding your phone, not someone guessing offline against a copy.
How your files are encrypted
Bunker uses a small set of standard building blocks and nothing else:
| Purpose | What we use |
|---|---|
| Encrypting files, thumbnails, the index and records | AES-256-GCM (96-bit nonce, 128-bit tag), through Apple CryptoKit |
| Turning Patterns, Passphrases and Recovery Phrases into keys | Argon2id, through libsodium (our only third-party crypto library, pinned) |
| Deriving keys from other strong keys | HKDF-SHA256, through CryptoKit |
| Sealing items from the share extension | HPKE (RFC 9180: X25519, HKDF-SHA256, AES-256-GCM), through CryptoKit |
| Splitting a Legacy key into cards | SLIP-0039, checked against its official test vectors |
| Content hashing | SHA-256, through CryptoKit |
| Randomness | Apple’s system random number generator |
No custom ciphers, no older modes like AES-CBC or ECB.
Keys in layers. Each vault has a 256-bit random root key, made when the vault is created. Your Pattern, your Passphrase and your Recovery Phrase each only wrap that root key; they don’t encrypt your files directly. Every file then gets its own 256-bit random file key, wrapped under a key derived from the vault’s root key. So changing your Pattern re-wraps one key, works offline, and leaves your Recovery Phrase and backups working.
Large files in chunks. Files up to 1 MiB are sealed in one piece. Larger files, like videos, are sealed in 1 MiB chunks, each with its own nonce and its position in the file. A chunk that is removed, cut short or reordered fails to decrypt. Videos play by decrypting chunks as needed, with no plaintext copy written.
Names never sit in plain sight. Each file’s details (its original name, type, size, dates, dimensions, duration) are kept in a separate encrypted header. Thumbnails are encrypted with the file’s own key. Notes and the text read by Scan & Search are encrypted too.
What “binding” means. Every encrypted object is sealed together with a label of what it is (a file, a thumbnail, the index, a vault record) and which object it belongs to. If someone swaps two encrypted pieces, or moves one file’s chunk into another file, it fails to open.
Plaintext on disk, kept to a minimum. Some previews, exports and video from the Secure Camera briefly need a real file. They go into a protected temporary folder, excluded from backups, and are deleted when you finish, when the vault locks and on the next launch. Camera video is overwritten before deletion, though on flash storage that is best effort.
Leaks we close. Inside a vault, Spotlight and Siri suggestions, Handoff, Live Text, Writing Tools, third-party keyboards and Quick Look thumbnails are off. Copying text from a note happens only when you ask and stays on this device; on iPhone and iPad it also expires after 60 seconds. On lock, keys are dropped from memory. Notifications never mention a vault, a file or a person.
How vaults stay hidden
With Hidden Vaults you can make as many vaults as you like, each with its own Pattern, and no list of them exists in the app or on disk.
One file of identical slots. Every vault’s small records (its wrapped root key and where its index lives) sit in one slot file: 16,384 slots of 1 KiB each, always exactly 16 MiB, with every unused byte random. A record looks like any other slot. Each record is written to 3 positions that only its own key can calculate, and every unlock checks and repairs all 3 copies. A vault uses at most 12 slots.
One shared pool for files. Encrypted files from every vault are packed together into 4 MiB blobs with random names. Only a vault’s own encrypted index knows which blobs are its own. The pool’s total size shows how much you store in all, not how it divides between vaults. There are no files per vault, and every close resets all storage files’ times together, so none stands out.
A Pattern that opens nothing looks the same. The app always runs the full key derivation and checks all 3 possible slots, then reveals the result at a fixed moment, set by timing your device when the app is first installed. The animation, haptics and wording are identical for a Pattern that opens a vault and one that doesn’t, until the vault opens or the screen says “No vault opened”. That screen is the same for a mistyped Pattern and a brand-new one.
On Free, the count is kept. Free allows 3 Vaults and item totals across them, so the app keeps a small ledger on the device: one random tag per Vault and its counts. Someone examining the phone can count the Vaults from it. Bunker Pro deletes the ledger the moment it starts and never writes one, so with Pro everything above holds.
The Duress Vault. With Bunker Pro you can mark one vault as a Duress Vault. Opening it looks like any other open, and behind it the app erases every other vault’s records and encrypted files from this device. The mark is stored inside that vault’s own record, so nothing outside shows it exists. It only clears this device: your iCloud backup, your other devices and older device backups still hold your other vaults, and each comes back with its Recovery Phrase. Someone who forces you to draw your Patterns on a fresh install could restore them from iCloud.
Your Recovery Phrase
Every vault gets a Recovery Phrase when you make it: a generated sentence of about 12 everyday English words, like “seven quiet lanterns and four amber foxes gently cross a silver harbor”. The generator draws each word from fixed lists, so every phrase carries at least 100 bits of randomness. That’s why it needs no pepper and works even on a device that lost one. You can’t write your own: a chosen sentence is far easier to guess.
The phrase opens two recovery records: one in this device’s slot file and, if Encrypted Backup is on, one in your iCloud backup. Each uses its own salt, so no guessing table carries over between devices or accounts.
By default, a copy of the phrase is kept encrypted inside the vault, so you can see it again from Vault Settings → Recovery Phrase after drawing your Pattern. You can turn that copy off. You can also replace the phrase; the old one stops opening your iCloud backup once the old record is deleted, but an older copy of your data (an old computer backup, for example) still opens with it.
Print the phrase rather than saving it as a file. A PDF is an ordinary file: anyone who can open your files or your iCloud can read it. If you forget your Pattern and lose your Recovery Phrase, nobody can open the vault. That includes us.
Backup and sync: what iCloud sees
Encrypted Backup is free and on by default for each new vault. It stores your vault in your own iCloud, in a private CloudKit database Bunker can’t read.
What iCloud holds: encrypted packs padded to 4 MiB, encrypted manifests padded to fixed sizes (256 KiB and up), and decoy records mixed in so record counts reveal less. The backup is opened by a separate key derived from your Pattern (256 MiB Argon2id, with the cloud pepper) or by your Recovery Phrase. A device never applies a backup older than the newest it has seen.
What Apple can see: how much you store and roughly when backups ran. Each vault backs up on its own, which can hint at how many there are.
Restoring by Pattern on a new device needs the same Apple Account and iCloud Keychain on. Otherwise, or on a device that already holds vaults, use the Recovery Phrase.
Sync (Bunker Pro) uses the same encrypted format to keep a vault current across your iPhone, iPad and Mac on the same iCloud account.
On a Mac, iOS-style file protection classes don’t apply, so files at rest are protected by FileVault. Turn FileVault on in System Settings → Privacy & Security → FileVault.
Vault Sharing: the key stays in the link
With Bunker Pro, Vault Sharing publishes a read-only, encrypted copy of a vault or a selection. Each share has its own 256-bit random key. You send it as a link (the key is in the part after #, which browsers never send to a server), a QR code, or a 24-word code to read aloud. Our /s/ page removes it from the address bar at once.
The encrypted copy lives in CloudKit’s public database under a record name derived from the share key, so it can’t be found or listed without the key. Shares are limited to 500 MB.
Limits, plainly:
- If the link is opened in a browser, the key can stay in that browser’s history, which may sync through iCloud.
- The first claim uses up the link inside Bunker, but that rule is enforced by the app, not by the encryption. Until you revoke the share or it expires, anyone holding the key could still read it.
- Revoking stops future access. It can’t take back what someone already opened.
- CloudKit stamps each record with an anonymous ID for its creator, so someone with the record names of two shares could tell they came from the same person.
Items you send to Bunker from other apps are sealed with HPKE to a public key on your device, with names hidden and sizes padded to the next 64 KiB, until you open a vault and add them.
Legacy Vaults: cards that open nothing alone
A Legacy Vault (Bunker Pro) lets people you trust open a read-only copy of one vault together. Its own 256-bit random key is split with SLIP-0039, a published secret-sharing standard, into one Legacy Card per trusted contact. You choose up to 5 contacts and how many must come together: 2 of 3 by default, or any number from 2 up to everyone. One person on their own (1 of 1) is also possible, and that card says it opens the vault alone. Each card carries 33 words and a QR code, with built-in checks that catch a typo or a card from a different set.
The mirror the cards open is a separate encrypted copy, with fresh keys, in CloudKit’s public database, so it’s designed not to depend on your own iCloud account staying open. Its record names derive from the Legacy key, so nobody can find them without enough cards. It’s limited to 1 GB, with photos and videos at Optimized quality. An encrypted Legacy archive file you export opens with the cards even without iCloud.
Limits, plainly:
- In v1, Bunker doesn’t know whether something has happened to you. Enough trusted contacts acting together can open the copy at any time, including while you’re alive. Choose people you’d trust with it today.
- When contacts open it, their app writes an “opened” signal and your devices usually tell you. That relies on their app behaving honestly; a modified app could skip it.
- Changing contacts or the number needed issues new cards and deletes the old copy. People who already opened it keep what they downloaded, and an archive exported before the change still opens with the old cards. Destroy old archives.
- Legacy Vaults are not a will. They help people you trust reach your information; they don’t make legal decisions.
Read more on how Legacy works and how trusted contacts open one.
What we never collect
- No account. Purchases go through your Apple Account and are checked on your device; we run no receipt server.
- No content. We never receive your files, names, notes, scans, Patterns, Passphrases, Recovery Phrases or Legacy Cards.
- No ads, no ad identifiers, no tracking across apps.
- No analytics in Bunker 1.0. If we ever add usage analytics, they will be off unless you turn them on, limited to a fixed list of events that never include file names, types, counts per vault or anything that identifies a vault, and switched off for the session after a Duress Vault opens.
- Feedback stays in your hands. Send Feedback opens your own Mail app. Nothing is sent until you tap Send.
Our Privacy Policy has the details.
Who Bunker protects you from, and who it doesn’t
| Bunker protects against | Bunker doesn’t protect against |
|---|---|
| Someone with your unlocked phone who opens the app: they see only the vault whose Pattern they know | A compromised or jailbroken device, malware, or a malicious system update |
| Someone who copies the app’s files or an unencrypted computer backup: ciphertext only, no vault count in a single copy, and no way to test Pattern guesses | A Pattern someone watched you draw |
| Us, and CloudKit as a storage service: no plaintext and no keys | Someone who finds your written Recovery Phrase |
| A forced unlock, partly: Hidden Vaults and the Duress Vault, on this device | Offline guessing of a weak Pattern by someone who has your data and your device pepper: chiefly someone holding an encrypted computer backup and its password, or anyone who can read your iCloud Keychain |
| Casual looks over your shoulder and screen capture (best effort) | Comparing several backups over time, the total storage size, or a forensic image of the device, which can hint at how many vaults you use |
| Someone who can read your iCloud data estimating how many vaults back up and their sizes | |
| A copy someone took before you changed your Pattern: the old Pattern still opens that copy | |
| A share recipient or trusted contact keeping what they already downloaded after you revoke or change it | |
| Someone forcing you to draw your Patterns on a fresh install: the Duress Vault doesn’t touch iCloud backups | |
| Forensic recovery of deleted data from flash storage | |
| Enough trusted contacts acting together, at any time (v1) | |
| Someone photographing the screen of a shared or Legacy copy |
Known limits, stated plainly
- Argon2id slows guessing; it doesn’t stop it. Someone with your data and your device pepper can guess a weak Pattern offline. Use 8 or more dots with several turns, or add a Passphrase.
- Changing your Pattern doesn’t lock out an old copy. Rotating every key at once is planned, not yet in the app.
- Screenshot blocking is best effort. On iPhone and iPad, vault screens come out blank in screenshots and are covered during recording or mirroring (the note editor, share cards and Legacy Cards get only the recording cover). It relies on how iOS draws protected content today, so an iOS update could stop it working. On a Mac, some capture tools ignore the request. Another camera can always photograph the screen.
- Your unlocked phone and your Pattern open that vault. Bunker can’t tell you from someone who forced you.
- We can’t recover a forgotten Pattern without your Recovery Phrase. There is no reset, by design.
How Bunker was reviewed
Bunker’s cryptography was reviewed by three independent AI review agents, each started fresh with only the code, the tests and the design. One hunted for implementation bugs. One attacked the design as an adversary holding a copied phone, its backups, the owner’s iCloud data and partial Legacy Cards. One checked every security claim on this site, in the App Store listing and in the app against what the code does. They reviewed the core when it was built and again before launch. Every finding was fixed or answered in writing, and several limits on this page are here because a reviewer found them.
That is not the same as a paid audit by a security firm, and we don’t claim one. We intend to commission one when the app can fund it. The VaultCrypto package, the part that does the cryptography, is published as open source so anyone can check it.
Report a vulnerability
If you find a security problem, email [email protected]. Tell us what you found, the app version and device, and how to reproduce it. Please give us reasonable time to fix it before publishing, and don’t access other people’s data while testing. We reply to every report and credit you if you’d like.
For anything else, see Support, the manifesto and who builds Bunker.
Questions
Can Bunker open my vaults?
No. Your keys are made on your device and wrapped by your Pattern, your Passphrase or your Recovery Phrase. We have no account for you, no copy of your keys and no server that stores your files, so there is nothing we could hand over or open.
What happens if I forget my Pattern?
Use your Recovery Phrase from the unlock screen (Use Recovery Phrase), then choose a new Pattern. Without the Pattern, a Passphrase you added or the Recovery Phrase, nobody can open the vault, including us.
Can someone tell how many vaults I have?
Not from a single copy of the app's storage: the slot file is always 16 MiB of random-looking bytes and there is no list of vaults. Comparing several backups taken at different times, the total storage size, or a forensic image of the device can hint at how many vaults are in use.
What does iCloud see when I use Encrypted Backup?
Encrypted packs, padded to fixed sizes, plus decoy records. Names, types, thumbnails and notes are encrypted before upload. Apple can see how much you store and roughly when each backup ran, but not what is in it.
How do I report a security problem?
Email [email protected] with the details and how to reproduce it. We reply to every report and credit you if you'd like.