Get started with the iOS app

This guide walks you through the VaultKeepR iOS app from a fresh install to a fully working vault. No account is needed at any point: your vault lives on your device, encrypted with your master password.

Install

Install VaultKeepR from the App Store. The public repository contains the SDK, not the iOS app source. The app works offline from the first launch; network features (sync, breach checks, document sharing) are optional and only used when you enable them.

Create your vault

When you first open the app, you create a vault protected by a master password.

• No email address. The vault is not tied to an identity. You choose a master password and nothing else.
• The master password never leaves your device. It derives your encryption key locally with Argon2id and encrypts everything with XChaCha20-Poly1305. VaultKeepR cannot read your data, and there is no password reset: if you lose the master password, the vault cannot be opened.
• Choose it well. Because there is no reset flow, use a long passphrase you can remember. The built-in password generator can help you craft one.

Once the vault is created, it is stored encrypted on the device. Unlocking it later means re-entering the master password, or using Face ID / Touch ID if you enable biometric unlock.

Add your first entries

The vault is organized into four tabs:

• Credentials — usernames, passwords, websites and TOTP codes.
• Cards — payment card details.
• Notes — free-form secure notes.
• Identities — personal identity data for form filling.

Every entry supports smart tags, favorites and instant search. Adding an entry is local-only: the data is encrypted on device and nothing is sent anywhere unless you enable sync.

Biometric unlock

After unlocking with your master password, you can enable Face ID or Touch ID in the settings. When enabled:

• Your derived key and master password are stored in the iOS Keychain, protected by the Secure Enclave with BIOMETRY_CURRENT_SET access control.
• A single Face ID prompt unlocks the vault; no password entry is needed.
• If you change your biometric enrollment (add or remove a face or fingerprint), the stored keys are invalidated and you fall back to the master password.
• The keys are marked “this device only”: they are never backed up and never leave the phone.

For safety, the derived key is only cached in memory for 15 minutes of inactivity, and you can lock the vault manually at any time.

AutoFill on iOS

VaultKeepR provides credentials to Safari and any app through the iOS AutoFill system (the VaultKeeperCredentialProvider extension, backed by a shared App Group).

To turn it on:

1. Open the iOS Settings app.
2. Go to General → AutoFill & Passwords.
3. Select VaultKeepR as an autofill provider.

From then on, tapping a login field in Safari or an app offers your VaultKeepR credentials, after a Face ID confirmation. AutoFill works even while the main app is closed; the data it exposes is decrypted only for the fields being filled.

Two-factor authentication (TOTP)

VaultKeepR includes a TOTP generator, so you do not need a separate authenticator app.

• Add a TOTP secret to a credential entry (usually by pasting the otpauth:// setup code your service shows when enabling 2FA).
• The app generates rotating 6-digit codes next to the password.
• One tap copies the current code.

TOTP secrets live inside the encrypted vault: they are never transmitted and never readable without your master password.

Backup and IPFS sync

Sync lets a second device (or browser extension) share the same vault, without a cloud account.

How it works. Each device encrypts the vault with your master password, uploads the ciphertext to decentralized IPFS storage, and keeps the resulting CID (content identifier) locally. Other devices poll for CID changes, download the latest ciphertext and decrypt it locally. If both sides changed, a three-way merge reconciles the edits field by field.

Autosave and delegations. Background autosave uploads the encrypted vault whenever it changes. Uploads are authenticated with signature delegations: the app caches a signed delegation token in the Keychain (default validity 7 days, configurable) so you are not asked to re-sign on every change. The delegation authorizes the upload only; it never grants access to the vault content.

What the network sees. What leaves your phone is:

• The ciphertext only — passwords, TOTP secrets and vault contents are never transmitted in readable form.
• A fresh random salt per save, the ciphertext, a nonce and a commitment used to detect a wrong password without decrypting.
• The CID and your wallet address as lookup keys, plus your IP address to the storage operator, as with any network request.

Background polling runs on a configurable schedule (default 5 minutes; you can set it to manual or off in the Privacy section of the settings).

Tools

The app bundles a set of security utilities:

• Password generator with a strength meter.
• Breach scanner powered by HaveIBeenPwned using k-anonymity: only the first five characters of your password’s SHA-1 hash are sent, never the password itself.
• Email breach monitoring — register your email addresses and get alerted when they appear in known data leaks.
• Terms of Service analysis performed on-device by a local AI model.
• Encrypted file sharing protected by a PIN.
• NFC identity reading from biometric passports.
• Light and dark themes, or follow the system automatically.

If you lose your phone

Because the vault is encrypted and the master password never leaves your device, losing your phone does not mean losing your vault — if you set up recovery in advance. VaultKeepR supports digital legacy and recovery based on Shamir secret sharing: your key is split into encrypted fragments (3 of 5 required to reconstruct), distributed to storage channels and trusted contacts.

Set this up before you need it — see Recovery for the full walkthrough.