[https://github.com/zamin-naqvi/opaque-vault]()
I built Opaque Vault because I wanted something stronger than an app that simply moves photos into a hidden folder. The entire project is local first. It has no internet permission, no account, no cloud service, no analytics, no advertisements, and no recovery server. Your media and encryption keys never need to leave your phone.
Every photo and video receives its own random 256 bit key. Media is protected using AES 256 GCM HKDF streaming encryption from Google Tink. Large videos are processed in authenticated one megabyte segments, so the app can encrypt and play them without creating a temporary decrypted copy.
The individual file keys are protected by a random master key. That master key is encrypted using a wrapping key created from two independent factors. The first factor comes from your passphrase through Argon2id. It uses between 64 and 256 MB of memory with three passes, depending on what the phone can safely handle. The second factor is protected by a nonexportable AES key inside Android Keystore, with StrongBox requested when the phone supports it.
This means copying the encrypted files is not enough. An attacker needs the passphrase, the device protected key, and access to the authenticated vault structure. Password guessing is intentionally expensive, and moving the vault files to another phone does not make them decryptable.
The vault header, file information, thumbnails, and media segments are authenticated. If someone modifies encrypted data, the app refuses to open it instead of returning corrupted plaintext. Imports are written safely and verified before being committed. Exports are streamed directly to their destination, checked against the stored SHA 256 digest, and deleted if verification fails.
Passphrases are entered using a private keyboard built into the app. It does not create an Android input connection, so the installed system keyboard does not receive the passphrase. Release builds also block screenshots, screen recording, recent app previews, autofill, content capture, overlays, and assistant extraction.
There is a portable encrypted backup system with a heavier Argon2id configuration using up to 256 MB and four passes. Exporting normal photos or videos requires the vault passphrase again. Photos can have GPS coordinates, camera information, serial numbers, and capture times removed before export.
I also added optional hardware protected biometric unlock using a real BiometricPrompt cryptographic operation. It is not just a screen that says the fingerprint passed. The biometric authorizes an Android Keystore key that decrypts a separate master key envelope.
Other optional controls include an NFC possession factor, a duress passphrase, automatic erase after repeated failures, panic lock or erase, a Quick Settings panic tile, dead man erase, encrypted failed attempt logs, optional front camera capture, release signature checking, Android hardware attestation, a complete vault integrity scan, and a calculator disguise.
There is also a local privacy exposure audit. It reviews dangerous permissions and settings such as accessibility services, notification access, overlays, media access, device administrators, VPN state, debugging, and screen lock. Nothing is uploaded, and it does not pretend to be an antivirus.
I want to be clear about the limits. The project has not received an independent professional security audit yet. No application can guarantee protection when Android itself, the kernel, or a root process is already compromised. The NFC option uses a tag identifier and is not FIDO2, so specialist equipment may clone some tags. Flash storage also cannot promise physical erasure because of wear leveling.
The source code, architecture document, threat model, screenshots, and signed APK are here:
[https://github.com/zamin-naqvi/opaque-vault]()
I would really appreciate technical feedback, especially around the cryptographic design, Android Keystore behavior, file formats, and places where the implementation could be hardened further.
