A Sensitive Vault Behind Its Own Password: Extra Protection for What Matters Most
Most of your vault should be easy to reach: unlocked with a glance, recoverable if you lose your phone. But a few things deserve a second wall. A sensitive vault has its own password and can never be shared. Your recovery phrase can bring it back, but only your password, or its one-time recovery code, can open it. No backdoor, not even for us.
Security is not one setting turned up to maximum for everything. The passwords you use twenty times a day should be frictionless and easy to get back. But almost everyone has a short list of things that are different: a document, a few photos, a login whose exposure would genuinely hurt. For those, convenience is not the priority; a second wall is.
That is what a sensitive vault is for. It is one of the separate vaults you can now keep, but hardened on purpose: it has its own password, it can never be shared, and getting back in rests on things only you hold. You are trading a little convenience for absolute privacy, deliberately, with your eyes open.
Key takeaways
- A sensitive vault has its own password. On a device you already use it opens with Face ID or Touch ID; the password is what opens it on a new device, or after you restore from a backup.
- Your recovery phrase brings it back with your other vaults, but sealed: the 24 words alone cannot open it, only your password or its recovery code can.
- It cannot be shared with anyone, so its contents can never be handed out, even by accident.
- No backdoor, not even us. Either your password or a one-time recovery code opens it; lose both and no one, us included, can ever open it.
What makes it "sensitive"
Setting up a sensitive vault is a short, three-step ritual, and each step spells out a trade-off you are choosing:
| What you set | What it means |
|---|---|
| Its own password | You set it when you create the vault. On a device you already use, it opens with Face ID or Touch ID; the password is what opens it on a new device, or after you restore from a backup. |
| Recovery brings it back, sealed | Your 24-word phrase restores the sensitive vault along with everything else, but it comes back locked. The phrase alone cannot open it; your password does. |
| Cannot be shared | A sensitive vault has no invite. Its contents are for you alone. |
| A recovery code, as a fallback | At setup you save a one-time code. If you ever forget the password, that code is the other way in. Either one opens the vault; lose both and it cannot be recovered. |
This is the part worth stating precisely: your 24 words do restore the sealed vault along with the rest, they just cannot unlock it. Only your password, or the recovery code, turns that sealed vault back into a usable one, which is exactly why a recovered phrase on its own can never expose what is inside.
The absence of a backdoor is the feature. Because there is no master way in, no one, not an attacker, not a court order to us, not us on our best day, can open it without your password or your recovery code.
The trade-off, stated plainly
A sensitive vault puts recovery entirely in your hands. There is no "we'll help you get back in" path, because such a path would also be a way in for someone who is not you. Your 24-word phrase can restore the vault, but only your password or recovery code can open it, and we hold neither. This is the same logic behind zero-knowledge design, taken to its strictest conclusion.
What belongs in one (and what does not)
A sensitive vault is a small, sharp tool, not a second home for everything.
- Good fits: a handful of financial or legal documents, genuinely private photos, one or two logins whose exposure would be serious. Things you would not want anyone to reach even with your unlocked phone in their hand.
- Leave in your normal vault: everyday logins, IDs you use often, anything your family might one day need. Those belong where they stay convenient and recoverable.
Think of your vaults as concentric walls: your normal vault for daily life, a shared vault for what your household holds together, and a sensitive vault as the innermost room, whose only keys, your password and your recovery code, are held by you alone.
An innermost room, with no spare key.
Put your most private things behind a second wall: a sensitive vault with its own password, unshareable, with no backdoor. Alongside your everyday and shared vaults, on iPhone, iPad, and Mac.
Explore Kinship Vault