Secret Phrase: Your Vault's Recovery Lifeline

Vaultaire generates a custom nine-word recovery sentence rather than a 12- or 24-word BIP-39 mnemonic. PBKDF2-HMAC-SHA512 processes the normalized phrase for 800,000 iterations to derive a recovery key. That key opens an AES-GCM encrypted envelope containing the vault key locally, or the vault key and backup key when restoring an encrypted iCloud backup.

What Is the Secret Phrase?

Every Vaultaire vault has a layered key hierarchy. Your pattern derives a vault key, that vault key unlocks the encrypted index, and the index contains a wrapped random master key used for file encryption. But what happens if you forget your pattern? What if months pass and the muscle memory fades? Without a separate recovery path, the vault key would remain out of reach.

That is where the secret phrase comes in. When you create a new vault, Vaultaire generates a grammatical sentence containing nine ordinary English words — words selected from several role-specific lists using cryptographically secure randomness. This is a custom recovery format, not BIP-39. The words do not encode the pattern-derived vault key. Instead, the normalized sentence becomes the input to PBKDF2, and the resulting recovery key decrypts an envelope that contains the vault key.

Think of it this way: the pattern and recovery phrase are two credentials that can open different wrappers around the same vault access material. The pattern is the credential you use every day. The recovery phrase opens the emergency envelope you keep for the day that muscle memory fails or a new device needs to find an encrypted backup.

How the Secret Phrase Works

The secret phrase is a separate credential and therefore a separate way to attack or recover the vault. It is not another representation of the pattern-derived key. The phrase derives its own 256-bit recovery key, and that key authenticates and decrypts a small envelope containing the vault key. This separation lets the phrase remain portable while the normal local vault key remains bound to the device’s Keychain salt.

Generation

When you create a vault, Vaultaire selects words with cryptographically secure randomness and places them into one of several grammatical templates. The generated sentence normally contains nine words and is checked by the app’s phrase-strength estimator. You can also supply a custom phrase of at least six words if it passes validation. The phrase is normalized, processed through 800,000 PBKDF2-HMAC-SHA512 iterations, and used to encrypt the portable recovery envelope.

Display

Vaultaire shows the phrase during vault creation and asks you to confirm that you saved it. It also stores the phrase inside an AES-GCM encrypted recovery database in the iOS Keychain so the phrase can be displayed later from that vault’s settings and used to publish an encrypted recovery manifest when iCloud backup is enabled. Vaultaire does not receive the phrase on a company server or include it in analytics.

Recovery

If you forget your pattern, you open Vaultaire and choose the recovery option. On the original device, the encrypted recovery database maps the phrase to its envelope. For an encrypted iCloud restore, a deterministic locator finds the phrase-addressed recovery manifest. In either case, AES-GCM authenticated decryption verifies the phrase-derived key before releasing the vault access material. You can then open the vault and set a new pattern.

Why the Secret Phrase Exists

Vaultaire has no account service that receives your pattern, recovery phrase, vault key, backup key, or readable vault contents. Encrypted backups live in your private CloudKit database, and Vaultaire does not hold a separate provider recovery key. This removes a company-operated password reset path: support cannot replace a lost pattern or phrase with an account credential.

The secret phrase is Vaultaire’s answer to this tradeoff. It gives you a human-readable credential for an encrypted copy of the vault access material without giving Vaultaire a provider-held decryption key. The phrase is stored locally in protected Keychain data and should also be kept in a place you control. If neither your pattern nor a usable copy of the phrase remains, Vaultaire cannot reset the encryption from a company account.

Patterns are powerful and intuitive, but they rely on muscle memory. Life gets in the way. You might not open a vault for six months. You might switch phones and lose the physical familiarity of the gesture. You might have a medical situation that affects your fine motor control. The secret phrase ensures that none of these scenarios means losing your data permanently.

Security of the Secret Phrase

The secret phrase is one of the most sensitive credentials associated with your vault. Anyone who has the phrase and the matching local recovery data or encrypted iCloud backup may be able to recover the vault keys and access your data. That is why Vaultaire keeps its local copy inside encrypted Keychain storage — and why you should protect any copy you make.

Shown at Creation and Available in Settings

Vaultaire displays the phrase during vault creation so you can make an independent copy. The app can also load and display the saved phrase from the open vault’s settings. That convenience changes the threat model: somebody who can unlock the vault and reach its settings may be able to read the phrase, so the iPhone passcode, Vaultaire pattern, and physical control of the device remain important.

Encrypted Locally, Not Sent to Vaultaire

The phrase is saved in an encrypted recovery database stored as a WhenUnlockedThisDeviceOnly Keychain item. A separate random Keychain key protects that database with AES-GCM. When encrypted iCloud backup is enabled, Vaultaire uploads a deterministic phrase locator and an AES-GCM encrypted recovery manifest; the plaintext phrase is not placed in that record. The phrase is excluded from analytics and Vaultaire does not receive it.

No Recovery Without It

If you lose both your pattern and every usable copy of the secret phrase, Vaultaire has no account reset or provider-held key that can decrypt the vault for you. Whether local recovery remains possible then depends on what protected Keychain and vault data still survives on the device. An encrypted iCloud backup still requires its recovery phrase or the matching pattern-derived backup key.

Best Practices for Your Secret Phrase

Your secret phrase is the ultimate backup for your most private data. Treat it accordingly.

Write It Down on Paper

Use a pen and paper. Write each word clearly, in order, numbered. Paper cannot be hacked remotely. It cannot be compromised by malware. It cannot be silently exfiltrated from a cloud service. A piece of paper in a safe place is the most resilient form of backup storage ever invented.

Never Store It Digitally

Do not put an unprotected copy in a notes app, screenshot library, or email account. Every additional digital copy creates another place where the phrase could be exposed by malware, a data breach, or account compromise. Vaultaire already keeps a protected local copy for recovery and settings display; any extra copy should be secured according to the risk of the data you are protecting.

Keep It in a Safe Place

Store the paper somewhere secure and private. A home safe, a safety deposit box, or a locked drawer that only you access. Consider the same precautions you would take with an important legal document or a birth certificate. If you have multiple vaults, label each phrase clearly so you know which vault it belongs to.

Consider a Trusted Person

If something happens to you, should someone be able to access your vault? If so, you might give a copy of the phrase to a trusted family member or include it in a sealed envelope with your estate documents. This is a personal decision, but it is worth thinking about before the question becomes urgent.

How Recovery Works

The recovery process is straightforward, but it is worth understanding what happens at each step so you know exactly what to expect.

Step 1: Open the Recovery Screen

When you open Vaultaire and are prompted for your pattern, you will see a recovery option. Tap it, and the app presents a word-entry interface where you can type or select each word of your secret phrase.

Step 2: Enter Your Phrase

Enter the complete phrase in the same word order in which it was saved. Vaultaire normalizes capitalization and whitespace, but the words and their order still matter because they become PBKDF2 input. The generated format is a nine-word sentence, not a BIP-39 list, and a custom phrase may use a different number of words.

Step 3: Key Regeneration

Once the phrase is entered, Vaultaire normalizes it and runs PBKDF2-HMAC-SHA512 for 800,000 iterations with a deterministic phrase-derived salt. The same normalized phrase produces the same 256-bit recovery key on another device. AES-GCM then verifies that key against the local recovery envelope or cloud recovery manifest before any vault or backup key is accepted.

Step 4: Set a New Pattern

After the vault is accessible again, Vaultaire can establish a new pattern. The random file-encryption master key remains unchanged, but the new pattern derives a new local vault key and a new deterministic backup key. Changing the pattern also generates a replacement recovery phrase and envelope, so you must save the new phrase before leaving the flow.