encodings
rounds
written to disk
requests
Read this first. Seven of the eleven methods are historical. They are fascinating, they are worth understanding, and a computer breaks every one of them in seconds. The app labels them Historical: not secure wherever they appear. If you are protecting something that matters, use one of the three methods labeled Authenticated encryption.
Getting started
Tap the method name at the top to choose a cipher. Type or paste into Message, enter a key if the method needs one, and the result appears below.
The historical ciphers transform as you type. The three modern ones wait for you to tap Encrypt or Decrypt, because turning your passphrase into a key takes a moment on purpose — that pause is 600,000 rounds of PBKDF2, and it is what makes guessing your passphrase expensive rather than instant.
The three modern methods
- AES-256-GCM — the block cipher the US government selected in 2001, in a mode that detects tampering as well as encrypting. Keyed from your passphrase.
- ChaCha20-Poly1305 — a stream cipher by Daniel J. Bernstein with the Poly1305 authenticator. Fast without special hardware, same passphrase stretching as AES.
- X25519 Sealed Box — encrypts to someone's public key, so there is no shared passphrase to arrange in advance. Only the matching private key opens it, and not even you can reopen it once sealed.
All three come from Apple's own cryptography. The app contains no third-party code of any kind.
The seven historical ciphers
- Caesar — every letter moves a fixed number of places down the alphabet. Named for Julius Caesar, who used a shift of three.
- ROT13 — a Caesar cipher fixed at thirteen. Applying it twice returns the original.
- Atbash — the alphabet reversed. A Hebrew scribal cipher older than Caesar, and its own inverse.
- Vigenère — a Caesar shift that changes with every letter, driven by a repeating keyword. Called unbreakable for three centuries.
- Playfair — encrypts letters two at a time against a five by five keyed square. Used by the British Army in the Boer War and both world wars.
- Rail Fence — writes the message in a zigzag across several lines, then reads it off line by line.
- Polybius Square — each letter becomes its row and column in a five by five grid, described by the Greek historian Polybius around 150 BC.
And one utility
- Base64 — rewrites data as 64 printable characters so it survives systems that would otherwise mangle it. Useful for moving text through email, config files and forms.
It is not encryption, and the app labels it Encoding only: not secure rather than letting it sit alongside the ciphers as though it were an alternative. Anyone can decode Base64 in seconds without a key of any kind. That makes eleven methods in total: seven historical, three modern, and this one.
Questions
Does the app send my messages anywhere?
Not by itself, and that is a matter of construction rather than policy. There is no networking code in the app and it requests no network permission from iOS. Turn on Airplane Mode and every feature still works, because none of them ever needed a connection.
Sharing is the exception, and it is one you make deliberately. Tapping Share hands the result to whichever app you choose, and from that moment it is in that app's hands rather than this one's. Worth remembering if you ever share a decrypted message: it will then live wherever you sent it, under that app's rules, which may include its own backups.
Why did Playfair or Polybius mangle my punctuation?
Both are built on a five by five grid that holds only twenty-five letters, so they discard spaces, punctuation and capitalization, and merge J into I. Playfair also inserts an X between doubled letters and pads an odd-length message. Decrypting cannot put any of that back.
This is how the ciphers genuinely worked, not a shortcut. The app warns you on both methods before you use them rather than after.
I get "wrong passphrase, or this message was altered". What does that mean?
The three modern methods authenticate as well as encrypt. Every message carries a tag that is checked before anything is decrypted, so the app can tell the difference between a message that arrived intact and one that did not.
It means one of two things: the passphrase does not match the one used to encrypt, or the message was changed after it was encrypted — even by a single character lost in a copy and paste. The app cannot tell you which, because the check that catches one catches the other.
Can I decrypt something encrypted by another app or website?
For the seven historical ciphers, usually yes — they are standard and well defined. Playfair and Polybius have variants, so a keyword square built differently will give a different answer.
For the three modern methods, no. They travel in a container that carries the algorithm, the salt, the key derivation settings and the nonce, so a recipient needs nothing but the passphrase. Another tool will not recognize that container, and Cipher Vault will not recognize theirs.
What is a sealed box, and how do I use one?
It lets someone send you a message without the two of you agreeing a passphrase first. Open Key tools and generate a keypair. Share the public key freely — post it, email it, print it. Keep the private key.
Anyone with your public key can seal a message that only your private key opens. Not even the sender can reopen it afterwards; that is the point of it.
What happens if I lose my private key?
Anything sealed to it becomes permanently unreadable. There is no recovery, no reset and no back door, because there is no server holding a copy. Save it somewhere you trust before you rely on it — a password manager is the right home for it.
Does the app store my private key?
Only if you ask it to. The option is off by default. If you turn it on, the key is stored in the iOS Keychain marked for this device only, so it never syncs to iCloud and never appears in a backup, and you can delete it with one tap.
Nothing else is ever stored. Your messages, passphrases and results are never written to disk under any setting.
Is Base64 encryption?
No, and the app says so on the method itself. Base64 rewrites data using 64 printable characters so it survives systems that would otherwise mangle it. It hides nothing — anyone can decode it in seconds. It is included because it is genuinely useful, and labeled Encoding only: not secure so nobody mistakes it for protection.
How strong does my passphrase need to be?
Strong. AES-256 is not the weak link in your message; your passphrase is. Six random words beat a short clever one, and length beats substituting 3 for E.
The 600,000 rounds of PBKDF2 make each guess expensive, which buys a great deal against a weak passphrase but cannot rescue a guessable one. If you want one generated properly, the companion app Ares Intel: Password Generator is free.
The result on screen shows a hyphen. Is it part of the message?
No. If a long line of encrypted text wraps, the system may draw a hyphen to break it, and that hyphen is not in your data. Always use the Copy button rather than retyping what you see. If you do transcribe by hand, the app ignores stray hyphens and spaces when reading a key back in.
Does it work offline, and does it need an account?
It works entirely offline and there is no account. No sign up, no email, no subscription, no advertising identifier, and no analytics of any kind.
Which iPhones does it run on?
Any iPhone running iOS 17 or later. It is portrait-only and built for iPhone rather than iPad.
Contact
Bug reports, questions and requests all reach me directly:
GenshiMediaGroup@gmail.comCraig Anthony Perkins · Ares Intel: Cipher Vault