Why Every Document in Your Vault Should Have Its Own Key
If a single lock protects everything you own, a single mistake can expose everything you own. Here is why the documents in a good vault each get their own key, and why that quietly matters.
Imagine keeping every valuable you own inside one big safe with one key. Convenient, until the day that key is copied, guessed, or handed to the wrong person. In that moment you do not lose one thing. You lose all of it, at once.
A lot of "encrypted" storage works exactly like that single safe. One master key protects the whole collection, so the security of every file rises and falls together. There is a better design, and it is almost invisible when it works: give every document its own key.
Key takeaways
- One master lock for everything means one slip can expose everything.
- Per-document keys shrink the blast radius of any single compromise.
- Think separate safes, each with its own key, rather than one big vault door.
- Kinship Vault gives every document and item its own key, sealed on your device.
The problem with one master lock
When a whole vault is encrypted under a single key, that key becomes a single point of failure. If it is ever exposed, in a backup, in memory, in a flawed implementation, then every item it protects is exposed with it. The damage is not proportional to the mistake. A small slip has the same reach as a catastrophic one, because everything shares the same lock.
Security engineers call the scope of a compromise its blast radius. With one key, the blast radius is the entire vault. The goal of good design is to make that radius as small as possible, so that if something does go wrong, it goes wrong in one place, not everywhere.
Separate safes, not one big safe
Per-document encryption flips the model. Instead of one key guarding a large room, each document sits in its own small safe with its own key. Open one and the others stay shut, because the key that opens one has nothing to do with the next.
A mistake that reaches one document should never be a mistake that reaches all of them.
This is a standard pattern in serious encryption design, sometimes described as envelope encryption: a per-item key protects the item, and a device-held master key protects the per-item keys. The important part for you is the effect. The unit of risk becomes a single document, not your whole life's paperwork.
Why the master key still matters
Per-document keys are not a replacement for a strong master key. They work together. The per-item keys are themselves wrapped by a master key that is generated on your device and sealed in secure hardware, the Secure Enclave on Apple devices or the Android Keystore. That hardware is what stops the key from being lifted off the device even if the storage is copied. We explain that layer in what the Secure Enclave is and why it matters.
So the structure is layered: the hardware protects the master key, the master key protects the per-document keys, and the per-document keys protect your documents. Each layer contains the failure of the one below it.
How Kinship Vault does it
Kinship Vault is built this way from the ground up. Your master key is generated on your device and sealed in its secure hardware, and every document, photo, password, and passkey gets its own key. Nothing is uploaded for processing, there is no Kinship Vault server holding your vault, and there is no master password on our side to reset. The full picture is in the security model documentation.
The short version
The question to ask of any vault is not just "is it encrypted" but "if one thing goes wrong, how much is exposed". A single master lock answers "everything". Per-document keys answer "one document". That difference is the whole point, and it is worth choosing a vault that gets it right. It builds on the same foundation we cover in on-device encryption, explained without the jargon.
A key for every document, sealed in your device.
Kinship Vault encrypts each item under its own key on iPhone, iPad, Mac, and Android. Even we can't open it.
See how Kinship Vault works