How Lockpic protects your files.

Your pattern helps create the key.

Lockpic does not save a password and compare future attempts with it. It encodes a valid 5×5 pattern and passes it through a key-derivation process. The result identifies and unlocks one vault.

Files are encrypted before they are stored.

Small records and key wrappers use AES-256-GCM. Photos and videos use authenticated streaming encryption with one-megabyte segments, allowing video seeking without writing a plaintext playback file.

• Vault metadata is encrypted and padded in 64 KiB buckets.
• Thumbnails are encrypted separately.
• Decrypted image disk caching is disabled.
• Memory caches are cleared when the vault locks.
• Authentication failures are treated as corruption rather than silently overwritten.

There is no master list of vaults.

Every valid pattern derives a vault identifier. A pattern can open an existing vault or an empty in-memory space. The interface never needs a list of "correct" patterns.

Encrypted media from all vaults shares flat blob and thumbnail pools. Random chaff makes simple file counting less useful. The app installation, total encrypted size, and storage patterns can still be visible to a forensic examiner.

Recovery depends on what was lost.

A 12-word recovery phrase can rebind a vault that still exists on the phone after the pattern or Android Keystore state is lost. It cannot recreate media that no longer exists.

Recovery after a lost, wiped, or uninstalled phone requires both the phrase and an exported encrypted Lockpic backup. Restore verifies and stages the complete backup before publishing it as a vault.

Lockpic also protects an open session.

• Release builds block ordinary screenshots, screen recording, and recents previews.
• The session locks when Lockpic backgrounds or reaches its inactivity timeout.
• Android backup and device-transfer extraction are disabled.
• Imports use Android's system Photo Picker; exports use the system Storage Access Framework.
• Storage operations hold a short-lived session lease so keys are not erased midway through a write.

What Lockpic cannot protect against.

Lockpic does not protect against a rooted or compromised operating system reading a live unlocked process, an attacker who knows the real pattern or phrase, privileged capture that bypasses Android protections, plaintext originals outside Lockpic, or device loss without a usable backup.

Key erasure on Android's managed runtime is best-effort. Libraries, decoders, video buffers, and the operating system may retain memory copies until reused. Lockpic has automated tests but has not yet received an independent security audit.

Read the complete plain-English threat model →