An offline vault for your photos, videos and files.
It can't send your data anywhere, because it has no internet permission at all.
Unlock with PIN, pattern, password or fingerprint · Hide it as a working calculator
Most vault apps ask you to trust a privacy policy. Sealbox doesn't need you to.
Its manifest has no INTERNET permission, so Android itself blocks every network call
it could ever make. You can check that in 30 seconds in
AndroidManifest.xml.
No ads. No accounts. No analytics. No cloud.
| AES-256-GCM encryption | Every file gets its own key. The master key is sealed by the Android Keystore, in StrongBox where the phone has it. |
| Decoy vault | A second password opens a vault that looks completely real and completely empty. |
| App disguise | Show up on the home screen as Calculator, Notes, Clock, System Service or Battery Care. |
| Working cover screens | The disguise really works: the calculator calculates. A 1.4-second hold on one spot opens the vault. |
| Encrypted playback | Videos and music stream straight from the encrypted file. No unencrypted copy is ever written. |
| Hidden file traces | Random file names, padded sizes and scrambled dates on disk. |
| Auto-lock | Locks when you leave the app or after 40 seconds idle. Screenshots and screen recording are blocked. |
| Tamper protection | Lockouts after wrong attempts, optional self-erase, and it refuses to unlock while a debugger is attached. |
Pick a lock, set it up, and you're in:
| Lock | Rule |
|---|---|
| Pattern | at least 5 dots, drawn twice |
| PIN | at least 6 digits |
| Password | at least 8 characters with upper, lower, digit and symbol |
| Fingerprint | optional, on top of one of the above |
Then choose a panic PIN, a decoy lock and a disguise if you want them. Setup makes you practise opening the disguise before you can turn it on, so you can never lock yourself out.
Your decoy is the same kind of lock as your real one (a decoy PIN for a PIN, a decoy pattern for a pattern). Enter it and the vault opens empty, and it stays empty for 24 hours no matter who tries. Your real lock ends that straight away. Nothing on screen gives it away. Even the add button still shows, and fails the way a broken file would.
Pick a disguise and Sealbox changes its icon and name on your home screen. With the cover on, it opens as that app, and the app works: the calculator does maths, the clock keeps time.
To get in, hold one spot for 1.4 seconds: the calculator display, the clock face, your chosen note, the version row, or the battery ring. That's long enough that it never triggers by accident, and the phone buzzes once when it opens.
Android only lets an app use icons that are built into its own APK, so the disguises are a bundled set of look-alikes rather than copies of any real brand.
- Master key: 256 random bits made on your phone, never derived from your password.
- Password key: PBKDF2-HMAC-SHA512, 210,000 iterations, unique salt.
- Double seal: the master key is wrapped by your password key, then wrapped again by a non-exportable Android Keystore key. Copying the data off the phone is useless without both your password and that phone's chip.
- Per-file keys: every file has its own random key, encrypted with the master key.
- Chunked AES-256-GCM: 64 KB chunks, a unique IV per chunk, and the chunk number bound in so chunks can't be reordered or swapped.
- No password flag: a wrong password simply fails the GCM check. There's nothing to patch.
Nothing recognisable is left on disk. The file name becomes 32 random characters with no extension, the size is padded by a random amount, and the date is set to a random point in the past. The real name, type, size and date live inside encrypted metadata.
Images decode in memory. Videos and music play straight from the encrypted file, decrypted one chunk at a time, and seeking still works.
For formats Sealbox can't show, you can open with another app or save a copy. Both create an unencrypted file outside the vault, and the app tells you so. Temporary copies are wiped the moment the vault locks.
- Locks when you leave the app, including the recent apps screen.
- Locks after 40 seconds without a touch (adjustable from 0 to 300).
- Blocks screenshots, screen recording and the recent apps preview.
- Wrong attempts get slower: 5 wrong costs a minute, 10 costs nearly an hour.
- Optional self-erase after a set number of failures. It destroys the hardware key first, so even an interrupted wipe leaves the data unreadable.
Read THREAT_MODEL.md. It covers what Sealbox does not protect against. Knowing the limits keeps you safer than trusting a vault blindly.
- Download the APK from Releases.
- Open it. Android may ask once to allow installs from this source, which is normal for apps outside the Play Store.
- Pick your lock and you're done.
Every push builds an APK with GitHub Actions. To build locally you need JDK 17:
git clone https://github.com/beworkall/sealbox
cd sealbox
./gradlew assembleDebugapp/src/main/java/com/beworkall/medialocker/
├── crypto/ key derivation, keystore wrapping, container format, shredding
├── data/ Room database, encrypted config store
├── files/ import/export, thumbnails, encrypted video source
├── security/ session, lock guard, tamper checks, disguises
├── ui/ screens, components, theme
└── vm/ view models
Start with crypto/StreamCipher.kt and security/Session.kt. Everything else builds on those two.
Found a problem? See SECURITY.md for how to report it privately.