Encrypted document storage for the papers that matter

Which files can I store?

The native apps can store PDFs, scans, spreadsheets, text files, photos, video and other selected files without a product-level file-size cap. Available device space and provider quotas still apply. Streaming encryption handles file contents in authenticated segments instead of requiring an entire large document or video in memory at once.

Photos have encrypted thumbnails, and supported images, PDFs, text and media open in a private preview after unlocking. Unsupported formats can be explicitly exported for another app. Such decrypted exports leave Revault’s protection boundary, so use the in-vault viewer when it meets your needs.

How is a document encrypted?

1. Each vault has its own key. When you create a vault, your device generates a random 256-bit AES master key. It is not derived from your pattern.
2. Your pattern protects that key. Your vault pattern and a random 256-bit device secret go through PBKDF2-HMAC-SHA-256 with 600,000 iterations and a fresh salt. The result is a wrapping key that encrypts the master key. The service receives only the encrypted master key; the device secret stays on your device.
3. Each file gets its own derived key. File contents are split into authenticated segments using the AES-256-GCM-HKDF streaming construction described by Google’s Tink library. If a segment is swapped, altered or cut short, it fails verification.
4. The details are encrypted too. Filenames, file types, thumbnails, vault names and folder structure are encrypted with AES-256-GCM before upload.
5. Mobile vaults need no Revault account. Optional native cloud access and store billing use their own platform accounts; neither replaces your vault unlock or recovery material.

A worked example: storing a scanned lease

Say you have a signed rental agreement as a PDF in your Downloads folder.

1. Create a vault, choose a unique device pattern and save the recovery phrase somewhere you can access without this phone.
2. Make a folder called “Home”. The folder name is encrypted along with the vault.
3. Import lease-2026.pdf. Its vault copy is encrypted on the phone and stays local unless you enable a sync provider or deliberately share or export it.
4. When cloud transfer is enabled, the provider can observe operational information such as encrypted object sizes and transfer times. The filename, Home folder and lease contents remain encrypted; your recovery phrase is not uploaded.
5. Check the saved pages and your backup before deciding whether to remove the original from Downloads or recently deleted. Importing does not remove the source.
6. Export an encrypted backup and test restoring it once.

What are the limits?

• Cloud activity is still observable. When you use a provider, it can see operational information such as object counts, sizes, timestamps and relevant provider or billing associations. Encryption does not make the transfer invisible.
• An unlocked device is exposed. Malware or someone looking at the screen can read visible data. The mobile apps lock immediately when backgrounded and after a per-vault inactivity timeout that defaults to 60 seconds.
• Local storage needs a recovery plan. Losing or resetting the phone, removing the app or deleting a vault can remove the only local copy. Keep a verified encrypted backup and matching recovery material elsewhere.
• Lose the recovery key, lose access. Revault cannot reset your way into a vault, because there is no provider-held master key.
• No independent audit yet. Revault is an independent project and has not undergone an independent security audit. The security model describes the design; it is not a certification.
• A copy is not the original. A scan helps you find document details. It does not replace the physical document.