Security is not an add-on.
It is the architecture.
NoirLock is built for passwords, passkeys, recovery phrases, access codes, API tokens, and other information that deserves more than ordinary storage. Sensitive data is encrypted on your device before it is saved or synchronized. NoirLock has no proprietary vault server, never stores your master password, and has no privileged mechanism for bypassing your encryption.
Security by design
Four principles carry the whole design.
On-device encryption
NoirLock encrypts sensitive data before persistence or synchronization. Decryption happens only on an authorized device after the vault is unlocked. Your master password and unencrypted vault contents are not sent to NoirLock — there is no vault service that could receive them.
A unique key for every item
Each vault item is protected with its own randomly generated 256-bit Data Encryption Key, separately wrapped by the vault key using authenticated encryption. Records are isolated from each other, and deleted items have their wrapped keys removed from the active key hierarchy.
More than a master password
Every new vault receives an independently generated 256-bit Secret Key. NoirLock combines it with the master password before Argon2id derivation, adding high-entropy key material that is independent of the password a person can remember.
Hardware-backed biometrics
Face ID and Touch ID provide convenient local access through a private EC-P256 key generated inside Secure Enclave. The private key does not leave the protected hardware, and biometric enrollment changes invalidate the biometric unlock path.
Key architecture
From your credentials to an encrypted vault item.
NoirLock uses purpose-separated keys and authenticated metadata. Record identity, type, format version, and revision are cryptographically bound to each encrypted envelope. Unauthorized changes cause authentication to fail instead of returning modified plaintext.
Your credentials
Master password + random 256-bit Secret Key
Key derivation
Argon2id v1.3 — 64 MiB, 3 passes, parallelism 1
Purpose separation
HKDF-SHA-256 purpose-separated keys
Vault key
AES-256-GCM wrapped random 256-bit vault key
Item key
AES-256-GCM wrapped random per-item key
Your data
AES-256-GCM encrypted password, note, TOTP seed, passkey, or secret
Cryptography
The cryptographic profile.
Vault item encryption
AES-256-GCM
Confidentiality and integrity
Item key
Random 256-bit key for every item
Item isolation and key lifecycle control
Password derivation
Argon2id v1.3, 64 MiB, 3 passes, p=1
Memory-hard resistance to offline guessing
Independent key material
Random 256-bit Secret Key
Entropy independent of the master password
Purpose separation
HKDF-SHA-256
Separate wrapping and verification keys
Biometric protection
Secure Enclave EC-P256 with ECIES
Hardware-backed local convenience unlock
One-time passwords
RFC 6238 TOTP
Standards-based local authentication codes
Passkeys
WebAuthn/FIDO2 with ES256
Phishing-resistant credentials
Protected by default
More than password fields.
NoirLock’s authenticated encrypted payloads cover every part of a record — not just the secret itself.
Search is available only while the vault is unlocked. It runs against an in-memory index built from protected metadata rather than a persistent plaintext search index.
Secret Key
Two protection modes. Your balance to choose.
NoirLock lets you choose the balance between convenient access and stricter separation of key material.
Standard
Convenient by default
A device-only copy of the Secret Key is protected by Apple Keychain and is not synchronized. This enables password-based manual unlock on an already enrolled device while preserving the Secret Key requirement for new-device enrollment.
Advanced
Stricter separation
The Secret Key is not retained for manual unlock. You provide it together with the master password whenever a manual unlock is required. Advanced mode offers stronger separation for users who maintain their Secret Key independently.
The Secret Key includes a checksum to help detect transcription errors. Keep a verified backup in a secure location separate from your everyday devices.
Secure Enclave
Biometrics without exposing keys.
NoirLock generates an EC-P256 key pair directly inside Secure Enclave. Biometrics are a convenience layer, not a replacement for the vault credentials. If biometric authorization is canceled, unavailable, or invalidated, NoirLock remains locked and returns to the manual unlock flow.
- The private key cannot be exported by the app
- It is released for cryptographic use only after biometric authorization
- It is bound to the current Face ID or Touch ID enrollment
- It becomes unavailable when biometric enrollment changes
Private Sync
Zero-knowledge synchronization through your iCloud.
NoirLock is local-first and does not require a NoirLock account. When iCloud sync is enabled, encrypted vault records are synchronized through your private CloudKit database.
Authorized Apple device
Encrypt on device
Private CloudKit database
Encrypted records only
Enrolled Apple device
Authenticate and decrypt locally
NoirLock does not upload the master password, plaintext vault key, or decrypted vault contents. An encrypted vault header on a new device does not grant access on its own: enrollment still requires the user’s vault credentials and Secret Key.
Incoming records are validated and authenticated before they can replace local state. NoirLock also works offline, allowing you to access and update your vault without depending on a live connection.
AutoFill and Passkeys
AutoFill without exposing the main vault.
The AutoFill extension does not receive the primary vault database or master vault key. It uses a separate encrypted projection designed specifically for credential filling. Domain matching checks canonical host relationships and rejects deceptive lookalike domains; for passkeys, NoirLock requires the relying-party identity to match the credential’s registered scope.
Passwords
Fill credentials in Safari and supported apps without copying them into unrelated interfaces.
One-time codes
TOTP secrets remain encrypted at rest and are used locally to calculate standards-based codes.
Passkeys
Passkey private keys use the same per-item encrypted architecture as other vault secrets, with registration and assertion handled through the system credential-provider flow.
Privacy
Designed to protect information, not monetize behavior.
When the vault locks, decrypted interface state and sensitive input fields are cleared. Privacy protection is also applied when the app moves to the background or the screen is being captured.
App lifecycle
Protection throughout everyday use.
- Manual and automatic locking
- A privacy cover outside the active foreground state
- Screenshot and screen-recording protection flows
- Optional local-only clipboard behavior
- Immediate clipboard clearing in Maximum Security mode when the vault locks
- Persistent progressive delays after repeated failed unlock attempts
- Encrypted draft recovery instead of plaintext autosave
- Cleanup of decrypted view state after locking
Backup and migration
Encrypted export, verified import.
NoirLock can export a password-protected encrypted archive for backup or migration. Import validates the archive format and authenticated encryption before changing vault contents. Interrupted imports can resume safely without duplicating completed records.
Protect exported archives with a strong, unique password and store them in a trusted location. This keeps backup security under your control.
Verification
Evidence, not assurances.
Release verification for the July 15, 2026 release candidate.
119 / 119
Automated tests passed
The full automated unit, integration, and security regression suite. Covered invariants include:
- Argon2id known-answer verification
- Authenticated-encryption tamper rejection
- Unique per-item keys
- Replay and rollback protection
- Keychain and biometric fail-closed behavior
- Authenticated CloudKit import
- Domain and passkey relying-party validation
- Encrypted export and recovery from interrupted import
- Locked-state and lifecycle data cleanup
10 / 10
Release gates completed
Release verification covered:
- Automated tests
- Debug and Release builds
- Compiler diagnostics
- Physical-device security flows
- Two-device synchronization
- Offline resynchronization
- Encrypted export and import
- Documentation alignment
- Residual-risk review
- Independent security assessment
Independent review
Completed July 2026
An independent security review completed in July 2026 reported a strong architecture and found no critical vulnerabilities within the reviewed scope.
Security assessment is point-in-time evidence, so material changes to cryptography, key management, synchronization, or platform entitlements require proportionate re-verification.
Designed for a clear security boundary
NoirLock protects vault data at rest, during synchronization, and while the app is locked. Like all software that must display decrypted information, it relies on the integrity of the device while the vault is actively unlocked. Keep your devices updated, use a strong device passcode, and install NoirLock only from an official distribution channel.
NoirLock cannot recover a vault when both the required master password and Secret Key have been lost. This is a deliberate consequence of a design in which the service does not retain a recovery key or privileged path into the vault.
FAQ
Frequently asked questions.
Can NoirLock read my vault?
No. NoirLock does not operate a vault server, does not receive the master password, and does not hold a plaintext vault key. Encryption and decryption happen on the user’s authorized device.
What if someone gains access to my iCloud account?
The private CloudKit database contains encrypted vault records and protected key material. Access to iCloud alone is not sufficient to decrypt the vault without the required NoirLock credentials.
Can NoirLock reset a forgotten master password?
NoirLock does not retain a service-accessible recovery key. Users should keep a verified backup of their Secret Key and ensure their master password is recoverable through their own secure process.
Why does NoirLock not offer support-assisted recovery?
A recovery mechanism controlled by a service also creates a path that can be targeted through account takeover or social engineering. NoirLock prioritizes user-controlled confidentiality and therefore does not retain a service-accessible recovery key.
Is Face ID my encryption key?
No. Face ID or Touch ID authorizes use of a local Secure Enclave key for convenience unlock. The vault credentials remain the foundation for manual unlock and new-device enrollment.
Are item titles and categories encrypted?
Yes. Item titles, subtitles, category names, and tag names are stored inside authenticated encrypted payloads. Search is performed in memory after the vault is unlocked.
Does NoirLock work offline?
Yes. NoirLock is local-first. Internet access is required only for optional synchronization through the user’s private iCloud database.
Own your secrets
Protection designed around your most valuable information.
NoirLock combines local-first storage, authenticated per-item encryption, an independent Secret Key, zero-knowledge synchronization, and Secure Enclave — without advertising profiles, support-accessible recovery keys, or a proprietary vault service.
iPhone, iPad & Mac
Technical references
Facts reviewed July 15, 2026. Security claims on this page describe the reviewed release implementation and its documented assumptions and boundaries.