Security is not an add-on.
It is the architecture.
NoirLock is built for passwords, passkeys, recovery phrases, access codes, API tokens, bank cards, identity documents, SSH keys, and other information that deserves more than ordinary storage. Sensitive data is encrypted on your device before it is saved or synchronized. NoirLock has no proprietary vault server, never stores your master password, and has no privileged mechanism for bypassing your encryption.
Security by design
Four principles carry the whole design.
On-device encryption
NoirLock encrypts sensitive data before persistence or synchronization. Decryption happens only on an authorized device after the vault is unlocked. Your master password and unencrypted vault contents are not sent to NoirLock — there is no vault service that could receive them.
A unique encryption key for every entry
Each vault item is protected with its own randomly generated 256-bit Data Encryption Key, separately wrapped by the vault key using authenticated encryption. Records are isolated from each other, and deleted items have their wrapped keys removed from the active key hierarchy.
More than a master password
Every new vault receives an independently generated 256-bit Secret Key. NoirLock combines it with the master password before Argon2id derivation, adding high-entropy key material that is independent of the password a person can remember.
Hardware-backed biometrics
Face ID and Touch ID provide convenient local access through a private EC-P256 key generated inside Secure Enclave. The private key does not leave the protected hardware, and biometric enrollment changes invalidate the biometric unlock path.
Key architecture
From your credentials to an encrypted vault item.
NoirLock uses purpose-separated keys and authenticated metadata. Record identity, type, format version, and revision are cryptographically bound to each encrypted envelope. Unauthorized changes cause authentication to fail instead of returning modified plaintext.
Your credentials
Master password + random 256-bit Secret Key
Key derivation
Argon2id v1.3 — 64 MiB, 3 passes, parallelism 1
Purpose separation
HKDF-SHA-256 purpose-separated keys
Vault key
AES-256-GCM wrapped random 256-bit vault key
Item key
AES-256-GCM wrapped random per-item key
Your data
AES-256-GCM encrypted password, note, TOTP seed, passkey, or secret
Cryptography
The cryptographic profile.
Vault item encryption
AES-256-GCM
Confidentiality and integrity
Item key
Random 256-bit key for every item
Item isolation and key lifecycle control
Password derivation
Argon2id v1.3, 64 MiB, 3 passes, p=1
Memory-hard resistance to offline guessing
Independent key material
Random 256-bit Secret Key
Entropy independent of the master password
Purpose separation
HKDF-SHA-256
Separate wrapping and verification keys
Biometric protection
Secure Enclave EC-P256 with ECIES
Hardware-backed local convenience unlock
One-time passwords
RFC 6238 TOTP
Standards-based local authentication codes
Passkeys
WebAuthn/FIDO2 with ES256
Phishing-resistant credentials
File attachments
AES-256-GCM with per-attachment keys
Encrypted files bound to their entry
Private Space
Separate Argon2id-derived key hierarchy
Isolation from the main vault key
Protected by default
More than password fields.
NoirLock’s authenticated encrypted payloads cover every part of a record — not just the secret itself. From a login to an identity document to a file attachment, the whole record is protected.
Search is available only while the vault is unlocked. It runs against an in-memory index built from protected metadata rather than a persistent plaintext search index.
Secret Key
Two protection modes. Your balance to choose.
Choose the protection mode that fits your needs: convenient access on an enrolled device, or stronger isolation of the Secret Key.
Standard
Convenient by default
A device-only copy of the Secret Key is protected by Apple Keychain and is not synchronized. This enables password-based manual unlock on an already enrolled device while preserving the Secret Key requirement for new-device enrollment.
Advanced
Stricter separation
The Secret Key is not retained for manual unlock. You provide it together with the master password whenever a manual unlock is required. Advanced mode offers stronger separation for users who maintain their Secret Key independently.
The Secret Key includes a checksum to help detect transcription errors. Keep a verified backup in a secure location separate from your everyday devices.
Secure Enclave
Biometrics without exposing keys.
NoirLock generates an EC-P256 key pair directly inside Secure Enclave. Biometrics are a convenience layer, not a replacement for the vault credentials. If biometric authorization is canceled, unavailable, or invalidated, NoirLock remains locked and returns to the manual unlock flow.
- The private key cannot be exported by the app
- It is released for cryptographic use only after biometric authorization
- It is bound to the current Face ID or Touch ID enrollment
- It becomes unavailable when biometric enrollment changes
Private Space and Pro protections
Protection for coercion, not just theft.
Most vault security assumes the attacker is remote. NoirLock Pro adds protections for the cases where the device is in someone else’s hands, or where the person holding it is being asked to unlock it.
Private Space
A separate key hierarchy derived from its own password and recovery key. Unlocking the main vault does not unlock it, and its records are excluded from main-vault listings, search, and AutoFill.
Travel Mode
Chosen categories are hidden across the whole app. It is armed and disarmed only from inside Private Space, so the visible state of the device does not indicate whether it is active.
Duress Unlock
A distinct code opens a decoy vault instead of the real one. The real vault stays sealed, and no interface element signals that a decoy was opened.
Panic Wipe
After a configured number of failed unlock attempts, this device’s vault data is erased. A wiped device can be re-enrolled later from your own iCloud with your vault credentials.
Self-destructing entries
An item can carry an expiry date, after which it is removed across your devices through the same authenticated sync path as any other change.
Emergency Access
A trusted person can reach categories you choose only after a waiting period you set, during which you can cancel the request.
Secure Sharing
An item can be sent as a one-time, end-to-end encrypted link. It is encrypted before it leaves the device, and the share is destroyed once it has been opened.
These features change what an attacker can reach on a device they control. They do not change the underlying guarantee: without your credentials, the encrypted data remains encrypted.
Hardened Mode
The strictest posture, in one switch.
Security options are only useful if they are actually enabled. Hardened Mode applies the strictest available settings together, so a cautious configuration does not depend on remembering to find each one.
- iCloud synchronization disabled
- AutoFill restricted to its maximum-security behavior
- Clipboard kept local to this device
- Immediate lock whenever the app leaves the foreground
Private Sync
Zero-knowledge synchronization through your iCloud.
NoirLock is local-first and does not require a NoirLock account. When iCloud sync is enabled, encrypted vault records are synchronized through your private CloudKit database.
Authorized Apple device
Encrypt on device
Private CloudKit database
Encrypted records only
Enrolled Apple device
Authenticate and decrypt locally
NoirLock does not upload the master password, plaintext vault key, or decrypted vault contents. An encrypted vault header on a new device does not grant access on its own: enrollment still requires the user’s vault credentials and Secret Key.
Incoming records are validated and authenticated before they can replace local state. NoirLock also works offline, allowing you to access and update your vault without depending on a live connection.
AutoFill and Passkeys
AutoFill without exposing the main vault.
The AutoFill extension does not receive the primary vault database or master vault key. It uses a separate encrypted projection designed specifically for credential filling. Domain matching checks canonical host relationships and rejects deceptive lookalike domains; for passkeys, NoirLock requires the relying-party identity to match the credential’s registered scope.
Passwords
Fill credentials in Safari and supported apps without copying them into unrelated interfaces.
One-time codes
TOTP secrets remain encrypted at rest and are used locally to calculate standards-based codes.
Passkeys
Passkey private keys use the same per-item encrypted architecture as other vault secrets, with registration and assertion handled through the system credential-provider flow.
Privacy
Designed to protect information, not monetize behavior.
When the vault locks, decrypted interface state and sensitive input fields are cleared. Privacy protection is also applied when the app moves to the background or the screen is being captured.
App lifecycle
Protection throughout everyday use.
- Manual and automatic locking
- A privacy cover outside the active foreground state
- Screenshot and screen-recording protection flows
- Optional local-only clipboard behavior
- Immediate clipboard clearing in Maximum Security mode when the vault locks
- Persistent progressive delays after repeated failed unlock attempts
- Encrypted draft recovery instead of plaintext autosave
- Cleanup of decrypted view state after locking
- Hardened Mode as a single switch for the strictest options
- Optional device wipe after repeated failed unlock attempts
Backup and migration
Encrypted export, verified import.
NoirLock can export a password-protected encrypted archive for backup or migration. Import validates the archive format and authenticated encryption before changing vault contents. Interrupted imports can resume safely without duplicating completed records.
Exports from 1Password (CSV and 1PUX), Bitwarden, Apple Passwords, Chrome, LastPass, KeePass, Dashlane, NordPass, Proton Pass, Enpass, RoboForm, and other CSV sources are parsed on the device. Items are presented for review before anything is written, likely duplicates are flagged for merge or skip, and the entire import can be undone within 10 minutes.
Protect exported archives with a strong, unique password and store them in a trusted location — and delete the export file from your previous password manager once migration is complete.
Verification
Evidence, not assurances.
Release verification for the August 2026 release candidate (6.08).
365 / 365
Automated tests passed
The full automated unit, integration, and security regression suite. Covered invariants include:
- Argon2id known-answer verification
- Authenticated-encryption tamper rejection
- Unique per-item and per-attachment keys
- Replay and rollback protection
- Keychain and biometric fail-closed behavior
- Authenticated CloudKit import
- Domain and passkey relying-party validation
- Private Space key separation from the main vault
- Duress and failed-attempt handling
- Self-destruct and expiry propagation
- Third-party import parsing and duplicate detection
- Encrypted export and recovery from interrupted import
- Locked-state and lifecycle data cleanup
10 / 10
Release checks passed
Release verification covered:
- Automated tests
- Debug and Release builds
- Compiler diagnostics
- Physical-device security flows
- Two-device synchronization
- Offline resynchronization
- Encrypted export and import
- Documentation alignment
- Residual-risk review
- Independent security assessment
Independent review
Completed July 2026
An independent security review completed in July 2026 reported a strong architecture and found no critical vulnerabilities within the reviewed scope.
The security assessment reflects a specific point in time. It covered the core cryptography, key management, and synchronization design, which remained unchanged in the August 2026 release. Features added later are covered by the automated test suite and the release checks listed above.
Designed for a clear security boundary
NoirLock protects vault data at rest, during synchronization, and while the app is locked. Like all software that must display decrypted information, it relies on the integrity of the device while the vault is actively unlocked. Keep your devices updated, use a strong device passcode, and install NoirLock only from an official distribution channel.
NoirLock cannot recover a vault when both the required master password and Secret Key have been lost. This is a deliberate consequence of a design in which the service does not retain a recovery key or privileged path into the vault.
FAQ
Frequently asked questions.
Can NoirLock read my vault?
No. NoirLock does not operate a vault server, does not receive the master password, and does not hold a plaintext vault key. Encryption and decryption happen on the user’s authorized device.
What if someone gains access to my iCloud account?
The private CloudKit database contains encrypted vault records and protected key material. Access to iCloud alone is not sufficient to decrypt the vault without the required NoirLock credentials.
Can NoirLock reset a forgotten master password?
NoirLock does not retain a service-accessible recovery key. Users should keep a verified backup of their Secret Key and ensure their master password is recoverable through their own secure process.
Why does NoirLock not offer support-assisted recovery?
A recovery mechanism controlled by a service also creates a path that can be targeted through account takeover or social engineering. NoirLock prioritizes user-controlled confidentiality and therefore does not retain a service-accessible recovery key.
Is Face ID my encryption key?
No. Face ID or Touch ID authorizes use of a local Secure Enclave key for convenience unlock. The vault credentials remain the foundation for manual unlock and new-device enrollment.
Are item titles and categories encrypted?
Yes. Item titles, subtitles, category names, and tag names are stored inside authenticated encrypted payloads. Search is performed in memory after the vault is unlocked.
Does NoirLock work offline?
Yes. NoirLock is local-first. Internet access is required only for optional synchronization through the user’s private iCloud database.
Is Private Space just a hidden folder?
No. Private Space has its own password, its own recovery key, and its own Argon2id-derived key hierarchy. Unlocking the main vault does not derive the keys required for Private Space, and its records do not appear in main-vault listings, search results, or AutoFill.
Are file attachments encrypted like everything else?
Yes. Attachments use the same authenticated per-item architecture as vault secrets, are bound to their entry, and synchronize only as encrypted payloads through the user’s private CloudKit database.
How does Secure Sharing stay end-to-end encrypted?
A shared item is encrypted before it leaves the device, and the link is single-use — it is destroyed once it has been opened. NoirLock does not retain access to the shared contents.
Is imported data from another password manager ever sent anywhere?
No. Import files are parsed and encrypted on the device. Items are shown for review before anything is written to the vault, and the entire import can be undone within 10 minutes.
Own your secrets
Protection designed around your most valuable information.
NoirLock combines local-first storage, authenticated per-item encryption, an independent Secret Key, zero-knowledge synchronization, Secure Enclave, and an isolated Private Space — without advertising profiles, support-accessible recovery keys, or a proprietary vault service.
iPhone, iPad & Mac
Technical references
Facts reviewed August 2026. Security claims on this page describe the reviewed release implementation and its documented assumptions and boundaries.