Feature
Pattern unlock
A gesture becomes your key, and nothing about it is kept.
Weave Vault opens on a 5×5 grid. You connect at least six dots, and that gesture is the input a key is derived from — not a password checked against a stored value, but the raw material the encryption key is built out of.
What happens when you draw
The path is canonicalised into bytes and passed to Argon2id with a random 128-bit salt held for that vault. Out comes a 256-bit key, which unwraps the vault's own key. The pattern itself is discarded the moment the derivation finishes; it exists in memory for as long as that calculation takes and no longer.
It is never written to disk — not in a file, not in the keychain, and not as a hash. There is nothing stored that a pattern could be compared against, which is also why the app cannot tell you that one was wrong.
Why Argon2id
Every vault app names its cipher and few name their key-derivation function, which is the part that actually differs between them. Argon2id is memory-hard: each attempt claims 64 MiB, so guessing cannot be spread cheaply across a rack of GPUs the way it can with older functions. It won the Password Hashing Competition and is OWASP's first recommendation for this job.
The rules the grid enforces
A pattern must connect at least six dots and change direction at least twice. These are mechanical limits, not a judgement about your pattern — the app does not score it, rate it, or tell you to pick a better one. Dots the line passes through on its way count as part of the pattern.
Why there is no Face ID, Touch ID or PIN
Each of those needs something stored to check against, and a stored secret is a thing that can be targeted. A pattern needs nothing stored, because it is the input rather than the answer. Fewer stored secrets is a cleaner design and a good deal less code.
If you forget it
Every vault also has a 12-word recovery phrase, shown once when the vault is created, which opens the same vault independently. If you lose the pattern and the phrase, that vault cannot be opened by anyone — including us, since there is nothing on our side to open it with.
Available on iPhone, iPad and Android.