How Cross-Platform Sync Stays End-to-End Encrypted, From iPhone to Android

Apple devices can share data through iCloud. Android devices can share data through Google Drive. There is no cloud both of them can open, so to put one vault on an iPhone and an Android phone at once, the coming update adds a relay: a small service whose only job is to pass sealed changes between the two ecosystems.

A relay is exactly where most "encrypted" sync quietly breaks its promise, so we set the rules before writing the code, and the code enforces them.

Step one: every device gets its own keys

When a device first joins a synced vault, it generates its own key pairs on the spot: an X25519 key for receiving sealed secrets and an Ed25519 key for signing. The private halves stay on the device. On iPhone, iPad and Mac they live in the Keychain, marked this device only, so they are never synced or backed up anywhere. On Android they are sealed under a hardware-backed Android Keystore key, inside StrongBox on phones that have one.

Only the public halves go to the relay. A public key is safe to publish: it lets anyone seal something to that device, and lets nobody open it.

Step two: the vault key is sealed to that device

Your vault has its own content key, made on your first device. To give a new device the vault, your existing device seals that key to the new device's public key: a fresh one-time X25519 key agreement, HKDF-SHA256 to derive a sealing key bound to both public keys and the purpose, then AES-256-GCM. The result is a small blob that only the new device can open. That sealed blob is the only form in which a vault key ever touches the relay.

Step three: proving the new device is really yours

Sealing a key to the wrong public key would be a disaster, so the hard part is knowing that the public key belongs to your new phone and not to someone sitting between the two. That is what the QR code is for.

• Your own devices. The existing device shows a code only after Face ID, Touch ID or your fingerprint, and only for 60 seconds. Its secret travels through the camera, not the network; the relay keeps only a hash of it, which cannot be turned back into the code. Showing it to your own phone is the approval.
• Other people joining a shared vault. They send a join request; you see it on your device and approve it only if the characters on their screen match the ones on yours. A request you have not approved gets nothing.

Each vault also has its own Ed25519 signing key, made when the vault is created and sealed to every owner. Changes to who is in a vault are signed with it, so every device checks the member list itself instead of trusting the relay's word for it.

Step four: syncing, and taking access back

From then on, every item, document, password, passkey, 2FA code, contact, is encrypted with AES-256-GCM under keys derived from the vault's content key before it is uploaded. Even the record identifiers are derived with keyed hashing, so the relay cannot tell a password from a passport. When you remove a device or a person, the vault moves to a new key epoch: fresh keys sealed only to the devices that remain. Anything written after that point is sealed with keys the removed device never had.

What the relay can and cannot see

To keep abuse off the relay, a device proves it is a genuine copy of the app on a real device (App Attest on Apple, Play Integrity on Android) before it can do anything that costs the service. That check is about the app, not about you. The full list of what is kept, and for how long, is in our privacy policy.

Why no passphrase-wrapped key sits on the relay

The easy way to build cross-device sync is to upload your vault key wrapped with a password, so any new device can download it and ask you for the password. Almost every cloud password manager does some version of this. It means a copy of your key, guarded only by something a human can remember, sits on a server forever, waiting for a breach and a fast password cracker.

The relay refuses that design outright. A new device gets a cross-platform vault by pairing with one you already have, never by downloading a passphrase-wrapped key. Every key the relay holds is sealed to a device, and the relay's keys are never written into a backup, so your recovery passphrase opens nothing that is waiting on the relay.

A key in the cloud guarded by a password is a breach waiting for a GPU. A key sealed to a phone in your pocket is not.

Why iCloud still syncs your Apple devices

It would have been simpler to move everything onto the relay. We kept iCloud for Apple-to-Apple and Google Drive for Android-to-Android for two reasons. First, it keeps the relay's role, and so its attack surface, as small as possible. Second, it means the relay is never a single point of failure: if it were unreachable for a day, your iPhone and Mac would keep syncing each other as they always have, and catch the Android up afterwards.