CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

The app binary version was set to 1.0 throughout initial development and is considered unstable and not resilient. Only app binary versions >2.0 should be used in production for this reason.

[Unreleased]

Added

• On the iPhone Duo's inner screen, partly folded, nothing sits across the crease. Held open like a book, the lock screen has the vault door and its words on one page and the Unlock button on the other, the sidebar meets the items at the crease, the items fill both pages either side of it when they fill the screen, and an item's page keeps to one page. Stood on a table, the lock screen has the door in the top half and the Unlock button in the bottom half. iOS says when the screen is partly folded but not where the crease is, so Vault takes it to run through the middle of the screen. Open flat, the screen keeps its usual layout
• Private keys as a new item type, on iOS and the Mac: WIF keys, extended private keys (xprv, yprv, zprv, tprv and the other SLIP-132 versions), raw hex secp256k1 keys, Nostr nsec keys, and OpenPGP, OpenSSH and PEM private keys, or any other text. Vault says what it recognises a key as, such as "WIF · mainnet · compressed" or "OpenSSH · Ed25519", checks its checksum where it has one, and warns about a public key entered by mistake, but derives nothing from it: no public key or address. Like a recovery phrase, a private key is always encrypted with a password and locked, masked until tapped, hidden while Vault is in the background or the screen is captured, and never copied or shown as a QR code. Help has a new page, "About Private Keys"

Changed

• Vault for iPhone and iPad now needs iOS 27 or iPadOS 27. With pointer authentication, the iPad app can't run on a Mac before macOS 26.5 (App Store Connect warning ITMS-91305), and moving to 27 takes care of that. The Mac app still runs on macOS 26
• Recovery phrases and private keys now come first when adding an item, and in Help. The new-item sheet on iOS and the Mac's New Item and File menus offer Recovery Phrase, Private Key, Note, then Code, with new descriptions, and on the Mac ⌘N makes a recovery phrase (a note stays on ⇧⌘N). A vault with no items offers the same four to add, in the same order, so a new person's first view points at phrases and keys. Help has a new page, "About Recovery Phrases", which opens the list with "About Private Keys", above the page about codes. The error for items that can't be loaded says items rather than codes, and the Mac's About lists recovery phrases, private keys, notes and codes in that order
• The iPhone, iPad and Mac apps run with Apple's Enhanced Security: pointer authentication, a hardened heap, checked allocations, and read-only dyld state, so a memory-safety bug in Vault or a library it uses is much harder to exploit. The AutoFill and widget extensions run with it too, as the AutoFill extension opens the vault with the App Lock Password. On iPhones with an A20 Pro chip or later, pointer arithmetic is checked for overflow too, in an arm64e.x1 slice of its own

Fixed

• On the iPhone Duo's outer screen, the lock screen's words and Unlock button sat to one side of the vault door, as its safe area is narrower on the camera's side. Everything beneath the door is now laid out across the middle of the screen, inside the safe area, so it's always lined up under the door
• App Review rejected the Mac app (guideline 2.4.5) as its AutoFill extension had the app's QR code scanner in it, which uses the camera, without the camera entitlement, which only the app has. The extension is now built from only what it needs, the lock screen, the codes and their search, so it has no camera code at all, and make validate and the release lane fail for any Mac bundle whose code uses the camera without the entitlement

[2.1] - 2026-10-13

Released on iOS. App Review rejected the Mac app's 2.1, so the Mac app is first released with 2.2.

Added

• A native Mac app, on the same App Store record as the iPhone and iPad app, free and with no in-app purchases. It keeps a vault of its own, with no sync: items move between devices with a backup or the QR transfer, as between iPhones. Its App Lock Password is always on, set at the first launch, and asked for after Touch ID or the Mac's password. It has the iPhone app's codes, notes and recovery phrases, search, duress passwords, hidden items, killphrases, backups and auto-backups, AutoFill of time-based codes in Safari, and a desktop widget that shows codes only while Vault is unlocked. Hide While Recording keeps its windows out of screenshots, recordings and screen sharing, and it locks when another app comes to the front (or once the Require Unlock delay has passed), when the Mac locks or sleeps, and when its window closes. See docs/mac-app.md

Changed

• Backup passwords and encrypted items' passwords are turned into keys with Argon2id, using 512 MB and 256 MB of memory, so each guess at a leaked backup or a copied item costs far more. Setting a backup password, or restoring a backup, takes seconds rather than minutes, and says it can take up to a minute. A backup password set before is strengthened in the background the first time Backups opens, without asking for it again, and backups made with it before still restore with it. An encrypted item is strengthened the first time its password opens it, with nothing else about it changed. A backup or item made by a newer version of Vault says to update Vault
• The count of wrong App Lock Passwords is kept in the keychain where only Vault and its AutoFill extension can read it, and Vault's widgets can't. It moves there the first time Vault or AutoFill opens after updating, as it was
• iOS and the Mac are released together, always with the same version and build number. Every target's version comes from VaultApp/Version.xcconfig, and make validate checks they all match

Fixed

• With an App Lock Password, killphrases and search passphrases stopped working in a vault moved to another Mac with Migration Assistant or a Time Machine restore: the keys that check them were kept in the keychain, beside the vault rather than in it. Each vault now keeps its own inside its encryption, so they go wherever it goes, and a duress vault has keys of its own. A vault made before this takes its keys in the first time it's opened, so open each vault once before moving it. Without the password, the keys stay in the keychain, as the vault isn't encrypted
• On a screen whose safe area is wider on one side than the other, such as the iPhone Duo's unfolded, the lock screen's vault door sat off-centre, as did the privacy and screen-capture covers'. The door is now in the middle of the screen, and the words and buttons beneath it move across to be under it as far as they can while staying clear of the screen's edges

[2.0] - 2026-10-07

Added

• Initial release
• Minimum deployment target is iOS 26 (iOS 26.5 for the widgets)
• Storage for secure notes
• Storage for 2FA codes (TOTP, HOTP)
• Backup export
• Backup encryption
• App icon generated from a SwiftUI view (VaultAppIcon) with light, dark and tinted variants, via make app-icon
• Locked items show the vault door from the app icon, which spins open when the item is unlocked. Turning the lock on and saving locks the item on the spot, door shutting and wheel spinning, so the lock is seen to work
• Recovery phrases (crypto wallet seed words) as a new item type. They're always encrypted with a password and locked with the device passcode, shown as a numbered list, and checked against the wordlist and checksum of BIP39 (all 10 languages), SLIP-39, Electrum and Monero phrases, with any unrecognized words highlighted, plus an optional description that's encrypted along with the words. Even once unlocked, the words stay masked until tapped. They're hidden while the app is in the background or the screen is being recorded, and there's no way to copy them
• App Lock, in a new Security section of Settings and off by default: Vault stays behind Face ID, Touch ID or the passcode, starting locked and locking again in the background, straight away or after 1, 5 or 15 minutes (Require Unlock). While it's on, the app switcher and Control Center only ever see a cover with the vault door
• An App Lock Password, set from App Lock in Settings, that encrypts the vault on this device and is asked for after Face ID or the passcode. It can't be reset, so the screen that sets it says so and shows when you last backed up. Wrong passwords wait longer each time, as iOS does, and the password can be changed or turned off. While it's on, widgets show Vault as locked, QuickType offers nothing, and AutoFill asks for the password before it shows any codes
• A duress password, set from the App Lock Password screen, that opens a separate, empty vault instead of the real one, with its own backups. Vault can also erase every vault after 10 wrong App Lock Passwords in a row, if you turn that on. Delete All Data deletes every vault, whichever one it's done from. The FAQ explains duress passwords, and how to start a duress vault again without it
• Hide While Recording, on by default: a cover hides the whole app, and the AutoFill sheet, while the screen is recorded, mirrored or shared, and it works without App Lock
• New Items settings: whether new codes and notes start locked, and whether new codes start out offered in QuickType
• Tap a Code To, in a new Codes section of Settings: tapping a code copies it (as before) or opens its details. Either way, touch and hold a code for Copy Code and Show Details
• Show Next Code, off by default: in the last seconds of its countdown, a time-based code shows the next code, smaller, above its timer bar. Copying still takes the current code
• Show in Spotlight, in the Codes section of Settings and off by default: find a code by its site's name in Spotlight and Apple Intelligence, and open it in Vault. Only while App Lock is off, and never account names, locked or hidden codes. Turning on App Lock turns it off

Fixed

• A scanned or imported code whose period or counter Vault can't work with is refused with an error, instead of being saved
• Backups containing an encrypted item (such as an encrypted note) couldn't be restored: the encryption IV's key didn't survive the backup's key encoding. The backup format is unchanged, so backups made before the fix restore too
• Removing a tag from an item didn't stick: the tag came back once the item was saved
• Restoring a backup turned QuickType back on for every code and reset every note's preview. Backups now keep both choices, and older backups restore as before
• A restore over the vault (Import & Override) that failed part way could leave the vault empty or half replaced. Now it leaves the vault untouched
• Deleted items, killphrases and search passphrases could linger in the vault's database files. Vault now scrubs them out after deleting or changing them, and again at launch, along with the database's own history of changes
• The Backups page could stop showing that a backup password was set when you came back to it
• Copying a PDF backup from its share sheet counted as saving it, and put the backup on the clipboard. Copy and Markup are gone from that share sheet, and a backup PDF's file only lasts while its share sheet is open, or until the Backups page next opens if Vault closed with the sheet open
• The editor's Tags, Encryption and Password rows needed a second tap to open their sheets
• VoiceOver read the editor's text fields and recovery phrase words without their names
• Killphrases didn't delete anything, and items that only show for their passphrase couldn't be found, after restoring a backup on another iPhone or after an erase. Backups now carry the keys that check them, and restoring one adds them to this device. Backups made before this don't carry them, so their phrases only work on the device that made them
• Moving the vault to another device with QR codes counted as a backup, so the Backups page and the App Lock Password screen could show a recent backup when nothing had been saved. Transfers aren't counted any more, including one made before this change
• At the largest text sizes, codes in the feed ran off the edge of the screen, and the item editor wrapped its titles a word to a line with "Continue" split in two. The feed now shows a card per row at those sizes, and the editor puts each step's icon above its title
• Codes with a period other than 30 seconds, such as 60, came out wrong in AutoFill's QuickType bar and in widgets, which always worked them out as 30 second codes. They now use the code's own period, as the feed does

Changed

• The keyboard no longer learns from anything typed into Vault: every text field, from note bodies and descriptions to passphrases, killphrases, searches and tag names, has autocorrection, predictive text and Writing Tools turned off, so none of it can turn up as a suggestion from Apple's keyboard in another app. Fields written like sentences still capitalize them. A third-party keyboard still sees what's typed outside password fields
• App icon refreshed: the same door and wheel, drawn flat in black on a white background (silver in the dark icon). A locked or encrypted item's door and the lock screen match
• The export page explains itself: a header says every export is the whole vault encrypted with your backup password, then the two options sit under "Keep a Backup" (a PDF to save or print) and "Move to Another Device" (QR codes for another device to scan, with no file saved), each saying what it makes and how to restore it
• Scanning a backup's QR codes says what to scan under the camera, then counts the codes as they come in. Each new code ticks off its tile with a light tap, and the last one plays the success haptic
• The vault inside a PDF backup or auto-backup is padded to a fixed size, at least 32 KB and then doubling, so a backup doesn't show how much its vault holds. A small vault's PDF backup has more QR codes as a result. Moving to another device isn't padded this way, so it stays quick
• A PDF backup's Password Hint starts empty, so all it shows in plain text is that it's a Vault backup, when it was made and how many pages and QR codes it has, unless you write a hint. It used to start with a sample description
• Decrypting an encrypted item plays its own take on the vault door: the wheel works a combination, turning one way, back the other and round to seat, then the door swings wide and the item opens. A wrong password floods the header red from the door, which rattles in its frame, and the error turns white as the red reaches it
• The feed's bottom bar minimizes while scrolling down, to a capsule showing the item count and active filter beside the search button (or the current search), and returns on scrolling up, at the top, or with a tap. It keeps its space while minimized, so the feed doesn't jump and still bounces at the bottom
• Search lives in the feed's bottom bar: the status bar sits bottom left and a search button bottom right, which opens the search field beneath the status bar. While searching, the status bar counts the matches alongside any tag filter
• The feed's bottom bar uses clear Liquid Glass with a scroll edge effect, and its tag filters and buttons have larger tap targets
• Everything copied from Vault follows the clipboard settings: text copied from notes and descriptions, text cut or copied while editing, a backup key's ID and codes copied from a widget are cleared after the Clear Clipboard time, and only reach other devices if Universal Clipboard allows it, which gains a Notes switch. The edit menu on notes and descriptions offers only Copy. Dragging a code out of the feed no longer drops it into another app, and still reorders the feed
• Text being edited offers only Cut, Copy, Paste, Select, Select All and Delete in its edit menu, without Share, Look Up, Translate or Search Web, and can't be dragged into another app. A recovery phrase's words can't be cut or copied while they're typed either
• Copied codes are cleared from the clipboard after 1 minute by default. Anyone who chose Never keeps it
• New codes are no longer offered in QuickType unless Show New Codes in QuickType is on
• QuickType no longer suggests locked codes
• Settings has a heading and short footer for every section, with icons colored by section, and Universal Clipboard opens its own sheet
• The App Lock Password shows the lock screen's vault door wherever it's set, changed or managed, so it's plainly the password the lock screen asks for. The backup password has a shield wherever it's set, entered or changed
• Decrypting a backup asks for its password under the backup password's shield, with the field ready to type in and Return to decrypt. While it works, it says how long it can take, and Cancel stops it. A wrong password shakes the field, and the right one opens the lock
• The Danger Zone is a sheet that says what deleting removes and what's kept, and asks you to confirm before it deletes anything. Deleting all data also deletes the backup password, so restoring an old backup afterwards needs its password
• Item pages look like the editor: the item's badge at the top and cards beneath it, with a larger live code on a code's page
• Tapping + opens one sheet that starts with the kinds of item to choose from, under its New Item title, and slides straight into the editor for the one chosen
• The Backups, Auto-Backup and Restore pages open with headers, and Backups leads with when you last backed up. Restore asks for Face ID or the passcode before it imports anything, even with no backup password set
• Auto-backup always keeps the newest backup it made, however long ago, so a shorter Keep Backups For time, or a vault that hasn't changed in a while, still leaves one
• Restore's import sheet opens with a header saying what's about to happen, with the symbol of the Restore row that opened it: importing, merging, or replacing the vault, in red. Choosing a PDF and scanning QR codes are rows beneath it. A file that isn't a backup says so in the header, with an error haptic, instead of in a red card
• Once the backup is decrypted, the import sheet's header says what importing will do, over a button named for it: Import, Merge, or Replace Vault in red. When it's done, a green tick bounces with the success haptic. If it fails, the header says why, with the button beneath to try again
• On a device with no passcode, Restore, the Backup Password sheet, the Danger Zone and deleting a set-aside vault say to set up a passcode, instead of asking to authenticate and failing
• When the vault can't be opened, its screen suggests restoring a backup of your iPhone or getting in touch, and says to keep Vault installed, since deleting the app deletes its data
• Auto-backup's cleanup only deletes backups it recorded making, instead of any auto-backup PDF in the folder. Existing setups are seeded once with the files the old cleanup would have deleted, so they carry on being cleaned up
• Choosing a shorter time in Keep Backups For asks first, and says that older auto-backups are deleted straight away
• The text in a code's timer bar is smaller and readable on every bar color
• Images in Markdown notes aren't loaded, so opening a note never goes online
• Widgets on the Lock Screen and in StandBy hide their codes, sites and accounts until the iPhone is unlocked, and copying a code from a widget asks for the iPhone to be unlocked first
• The Restore page offers Import & Merge and Import & Override only when the feed shows items. When it shows none, it offers Import Backup, which keeps anything already in the vault
• The AutoFill sheet locks when the iPhone does, as Vault does: with App Lock on, locking the iPhone with the sheet open hides the codes until the sheet is unlocked again
• Restoring a backup always asks for the password it was made with, even when it's the backup password set now. The backup password kept on the device only makes backups
• A new backup password has to be at least 8 characters, and not only numbers, like the App Lock Password. The form says so, and a password set before this keeps working
• The Backups FAQ explains that deleted items, including those a killphrase deleted, stay in backups made before they were deleted, and in an auto-backup folder until its older backups are cleaned up
• Any App Lock Password that opens Vault, your real one or a duress one, starts the waits after wrong passwords again, as well as the count towards erasing after 10, and the erasing settings say so. The Duress Password FAQ explains what that means for someone who has your duress password
• Setting a duress password asks for the current App Lock Password, which waits after wrong ones as changing the password does
• Encrypted items, recovery phrases and backups are encrypted with Apple's CryptoKit instead of the CryptoSwift library. It's the same AES-GCM, so everything encrypted before opens as it always has, and saving a backup is faster. All of Vault's encryption is now Apple's
• Help and the privacy policy say more exactly where Vault's data goes: the iPhone's own backups include the vault, and Vault has no analytics. The Duress Password page explains killphrases, and what can still give a duress vault away

Removed

• The hand-made VaultLogo.png app icon (replaced by the generated set)
• The Universal Clipboard switches for passwords and other content, which had no effect