What it does
When you add a photo, video or file to Kryptis, the app encrypts it with AES-256-GCM before writing it to storage. The same goes for the metadata: file names, dates, albums and thumbnails. Nothing readable is written in the clear.
AES-256-GCM is an authenticated cipher. That means a file that has been tampered with fails to decrypt instead of opening as something subtly wrong.
Where the key lives
On your phone. The key is derived from your vault passcode and never leaves the device. Kryptis has no account, so there is nothing to sign in to and no server holding a copy of anything. If you lose the passcode, the twelve-word recovery keys you saved at setup are the only way back in.
Why it matters
Hiding a file keeps it out of the camera roll. Encrypting a file keeps it unreadable in a backup, on a connected computer, or in the hands of anyone who gets at the storage. Most vault apps do the first and describe it as the second. How to tell the difference.
