How it works
Locked by maths.
Opened only by you.
What happens to a photo from the moment it enters your private library, step by step. All of it runs on your device, built from standard, well-studied pieces: Argon2id from libsodium, AES-256-GCM and HKDF from Apple’s CryptoKit, and the Secure Enclave.
1From passphrase to keys
One passphrase.
A key for every job.
Your passphrase is never used directly and never stored. It is stretched into a key that opens your slot in the key file, and what is inside that slot unlocks everything else.
You type
Your passphrase
Typed on your device. It is never stored and never sent anywhere.
Stretched
Argon2id
Three passes over 128 MiB of memory, with a random salt. Slow and memory-hungry on purpose, so every guess costs real time on any hardware.
Opens
Your slot in the key file
The result opens one sealed slot. Every slot is the same size, used or not, so the file does not show how many libraries exist. Your recovery key opens its own slot.
Unlocks
The vault key
A random 256-bit key, made once when you set up the library. It lives only in memory while the library is open.
Derives
A key for each job
HKDF turns the vault key into separate keys, so the key that seals your file names can never open a photo.
Recovery key
Made on your device when you set up the library. It opens its own slot in the key file, so it works when you forget your passphrase. Lumenkeep asks you to check it every 90 days.
Locked folders
A folder password or PIN goes through Argon2id too, and gives that folder its own key and its own recovery key. Opening the library does not open them.
Wrong guesses
Each wrong passphrase makes the next try wait longer. If you choose, everything here is erased after 10 wrong tries, with a warning from the 5th. It is off unless you turn it on.
2Sealing a photo
Cut into pieces.
Every piece sealed.
When a photo or video comes in, from the picker, the camera, the Share menu or a scan, it is encrypted before anything is written. Each item gets its own key.
Your photo
Read on your device
Chunked and sealed
AES-256-GCM, chunk by chunk
Written to disk
One encrypted file
- Chunks. 256 KB for photos, 1 MB for video, so a video can start from the middle without decrypting the rest. Nothing decrypted is written to disk.
- Sealed. Every chunk gets a 16-byte authentication tag. Change a single bit and that chunk is refused instead of shown.
- Bound together. Each chunk carries its number and the file’s identity, so chunks cannot be swapped between files, put out of order or cut off.
A new random key for this item
Every photo and video has its own 256-bit key.
Locked with your library’s file key
Sealed with AES-GCM by the “file keys” key from step 1, and tied to this item so it cannot be moved to another one.
Kept in the encrypted database
Delete the key and the file can never be read again.
3What is stored
Not just the photos.
Everything about them.
A file name or a date can say as much as a picture. Lumenkeep seals the details as carefully as the photos, so the storage holds nothing readable.
4Face ID and Touch ID
A glance to open.
Without giving up the key.
Optional for each library. Face ID unlocks a copy of the vault key held by this device’s Secure Enclave, and that copy never leaves the device.
Face ID or Touch ID
Checked by iOS. Lumenkeep never sees your face or fingerprint.
Secure Enclave
A key made inside this device’s Secure Enclave. It cannot be copied out, backed up or moved.
The vault key
Released only after a match. Change your Face ID or fingerprints and it stays shut until you type your passphrase.
5Backup and sync
Encrypted before
it leaves your hands.
Encrypted iCloud backup and iCloud sync are part of Lumenkeep Plus, and both are off until you turn them on. They go to your own iCloud, never to a server of mine. Sync sends only what changed.
What Apple can see
- That Lumenkeep keeps some files in your iCloud
- Their sizes and when they change
- Names made of random-looking letters
What it cannot see
- Your photos and videos
- File names, dates, places, albums, captions
- Your passphrase, recovery key or any key
Free You can also save an encrypted backup file to Files or a drive, test that it restores, and Export Everything in full quality at any time.
6Rotate Encryption
New keys,
for everything.
If you think an old key file or an old recovery key could have been copied, Rotate Encryption moves the whole library to brand-new keys, so nothing old can open what you keep now.
- Copy. Each photo and video is copied into a new file under a new key, straight from one encrypted file to the other.
- Check. Every copy is read back before it counts.
- Switch. Rewriting the key file is the single moment of change. If your battery dies before it, the old library is still whole and the half-made copy is cleared.
- Clean up. The old files are removed and you get a new recovery key. The old recovery key stops working.
7Deleting
Delete means
gone for good.
Encryption makes deleting final: once an item’s key is destroyed, no copy of its file can ever be read again.
You delete a photo
It goes to Recently Deleted, inside the private library, for 30 days.
Its key is destroyed
After 30 days, or when you choose Delete Now, the item’s own key is removed from the database.
The file is removed
Without its key, any copy left behind on the flash storage is unreadable.
8Screenshots and recordings
Out of the picture.
Even in a screenshot.
Private photos stay out of screenshots and screen recordings, and Lumenkeep covers itself before iOS takes the app-switcher snapshot.
What a screenshot gets
On iPhone and iPad, Lumenkeep draws private photos and videos in a layer that iOS leaves out of screenshots, screen recordings and mirroring. The capture shows an empty dark frame where the photo was, and Lumenkeep tells you a screenshot was taken.
It is on by default, with a switch in Settings. It relies on how iOS draws password fields; if a future iOS changes that, Lumenkeep still covers the screen while it is recorded or mirrored, and still tells you about screenshots. No app can stop another camera photographing the screen.
Honest limits
What this does not do
Encryption protects your photos when the library is locked. It cannot protect against everything, and I would rather say so plainly.
- While a library is open, anyone holding your unlocked device can see it. Lumenkeep locks when you leave the app, after a timeout you choose, when you fold an iPhone Duo, or with Lock Now.
- A device that is already compromised, or someone who can force you to unlock it, is beyond what any app can stop.
- If you lose both your passphrase and your recovery key, nobody can open the library, including me. There is no reset.
- Photos still in the Photos app, its iCloud, or shared elsewhere are outside Lumenkeep.
- The encryption design has not had an independent security review. It uses standard building blocks and is described in full here and on the security page.
Private by design.
Free to use.
Every protection on this page is in the free app. Encrypted iCloud backup and sync come with Lumenkeep Plus.