Technical Details

GeoLocker has two independent vault types, and you choose per vault which to use.

Every biometric vault, and the metadata index, has its own P-256 key generated inside the device’s Secure Enclave; the private key never leaves the chip and is gated on .biometryCurrentSet, so iOS invalidates it if the enrolled biometrics change.

Data is sealed with AES-256-GCM (Apple CryptoKit). The symmetric key is derived per message from an ephemeral ECDH exchange and HKDF-SHA256, so encrypting needs only the public key while decrypting requires the Secure-Enclave private key, and therefore a biometric prompt.

shared = ECDH(ephemeral_priv, vault_SE_pub)
K      = HKDF-SHA256(shared, ephemeral_pub ‖ vault_pub)
sealed = AES-256-GCM(K, plaintext)

For a biometric vault the location is enforced as a software access control (see below), not mixed into the key.

A hidden vault has no stored key and no stored salt. To open one you re-supply the spot and passphrase, and the key is derived on the spot:

cell    = grid_cell(spot, ~100 m)        // also tries neighbour cells
pinHash = Argon2id(passphrase, salt = HKDF(seSecret))
seSecret= ECDH(device_entanglement_key, fixed_point)   // device-bound, non-biometric
K       = HKDF-SHA256(pinHash ‖ seSecret ‖ cell)
open    = AES-256-GCM(K, slot_ciphertext)

A wrong passphrase or wrong cell yields a different key, GCM authentication fails, and the result is identical to “nothing here.” The device-bound entanglement secret means an exfiltrated copy can’t be attacked off the device. Argon2id (via libsodium) makes on-device guessing slow, its cost is the real barrier, so a longer passphrase and a non-obvious spot matter.

Not from an image alone. The key isn’t only spot plus passphrase — a third ingredient is mixed in: a secret that only the device’s Secure Enclave can produce, from a key-agreement step whose private key never leaves the chip. A copy of the storage doesn’t contain that key; what’s on disk is a wrapped blob that’s useless on any other hardware. Without the Enclave’s secret you can’t derive the salt or the key, so trying spots and passphrases offline gives you nothing to test against, there’s no match to find.

To attack it at all you have to be on the unlocked device, where the Enclave will do its part, or physically pull the key out of the chip, which is a lab-grade hardware attack. On the device, each passphrase guess still costs a full Argon2id pass: slow, and no faster on a GPU. Location is the cheaper factor, so its strength is really how hard your spot is to guess. A place no one would think of adds real difficulty; your home or office adds little against someone who knows you.

So location complements a strong passphrase rather than replacing it. The heavy lifting against guessing is Argon2id plus the Secure Enclave binding; location adds guess-space and the deniability that a wrong spot looks exactly like an empty phone. Pick a long, unique passphrase and a non-obvious spot. The honest caveat: this leans on a working Secure Enclave, which every current iPhone, iPad and Apple-silicon Mac has. If the Enclave itself were broken, offline guessing becomes possible again, limited only by Argon2id and how guessable your passphrase and spot are.

Hidden vaults live in a single fixed-size pool file created full of random data on first launch for everyone. Its size is one of a few standard tiers and never changes with how many vaults you have, so a forensic image of the device reveals nothing about how many hidden vaults exist, or whether you use them at all. Binary content (photos, video, files) is stored raw inside each slot, and every slot is padded to the same size.

A biometric vault’s unlock mode is enforced by a CoreLocation distance check: in-person-only vaults require the device to be within the radius (5–100 m, plus the device’s reported GPS accuracy); map-enabled vaults also accept a coordinate you point at. This runs in software and is not mixed into the key, so it is a real access control but not a cryptographic guarantee, a jailbroken device, GPS spoofing, or a modified app could bypass it. For a hidden vault the location is bound into the key cryptographically, while the “only when I’m physically here” option remains an app-level gate.

• If your device is unlocked and a vault is open, its contents are visible, like any app.
• Biometrics can be compelled in some places; biometric vaults are a biometric-only design. If that’s your concern, use a hidden vault, it opens with a spot + passphrase and no biometric, and its existence can’t be proven.
• On-device guessing of a hidden vault is bounded by Argon2id cost; a short passphrase or an obvious spot is only moderately strong.
• The location requirement is software-enforced for biometric vaults and can be defeated by spoofing or a modified app.
• The jailbreak check is advisory only; there is no recovery if you forget a hidden vault’s spot or passphrase.