Built by TengrX.
Real cryptography, explained in plain English.

In plain English: Think of a bank vault that requires two keys turned at the same time—one key stays in your head (your PIN, passphrase, 3×3 pattern, or safe dial), and the second key is physically welded inside your specific iPhone. Neither key works alone.

Technical reality: When you unlock Octoshield, your chosen secret is stretched using PBKDF2-SHA256 (slowing down brute-force guessing) and combined with a high-entropy random device key stored inside the iOS Keychain with device-only hardware protection. Even if someone copied Octoshield’s raw encrypted files onto a supercomputer, they could not even begin guessing your PIN without your physical iPhone’s Keychain key.

In plain English: Good security never uses the exact same lock cylinder on every door inside a building. Octoshield generates a fresh mathematical key for every individual photo, video, thumbnail, and catalog entry you import.

Technical reality: Your combined unlock key unwraps a random 256-bit vault master key. From that master key, Octoshield uses HKDF-SHA256 (HMAC-based Key Derivation Function) with unique context salts to derive separate 256-bit encryption keys for each file’s payload, its preview thumbnail, and the vault’s filename/metadata index.

In plain English: Instead of locking a long video inside one giant box that has to be unpacked all at once, Octoshield slices each file into half-megabyte pages, locks each page with its own tamper-evident wax seal, and opens only the page you are looking at right now.

Technical reality: Every imported photo, video, and PDF is split into 512 KB chunks and encrypted with AES-256-GCM (Galois/Counter Mode). Each chunk has its own unique nonce and 128-bit authentication tag. This enables instant, in-memory streaming playback for large 4K videos without writing a full decrypted video file to flash storage, while automatically detecting any tampered or truncated bytes.

In plain English: Many vault apps lock the big photo but accidentally leave tiny thumbnail previews or filenames like passport-scan.pdf sitting in plain sight inside their app folder. Octoshield locks the thumbnails and the table of contents too.

Technical reality: Both thumbnail images and the vault catalog index are encrypted at rest with AES-256-GCM. Optional Face ID / Touch ID uses a separate biometric-gated Keychain slot that invalidates if device biometrics change. When a document format requires a temporary decrypted preview file for iOS rendering, Octoshield wipes that scratch file the instant the preview closes or the vault locks.