How SpaceMoon protects your files

This page explains what SpaceMoon does, in plain words, and also what it cannot do. We would rather you know the limits than trust a promise that is too big.

In short

• All encryption happens on your phone. There is no SpaceMoon server and no account.
• Your files are encrypted with a random key. Only your pattern, your recovery phrase or your fingerprint can unlock that key.
• We, the developers, never have your pattern, your phrase or your keys. We cannot open your files, and we cannot reset your pattern.
• We use encryption built into Android and the well-known libsodium library. We did not write our own encryption.
• SpaceMoon has not yet had an independent security audit.

From your pattern to a key

You draw a pattern on a 5×5 grid, using at least 6 dots and no dot twice. SpaceMoon turns the pattern into a key with Argon2id, from libsodium (version 1.0.20 on Android).

• Settings: 64 MiB of memory, 3 passes, 1 lane, 256-bit key.
• Argon2id is slow on purpose and needs a lot of memory for every guess. This makes guessing with graphics cards much more expensive.
• On our test phones, one unlock takes about 0.6 to 0.9 seconds.
• The pattern is mixed with a random 16-byte device salt. The salt is stored in the app, encrypted with a key kept in the Android Keystore, which cannot be copied off the phone.
• No copy of the pattern is stored. The app checks a pattern by trying to unlock the key.
• After 5 wrong patterns in a row, you must wait 30 seconds. The wait doubles after each further mistake, up to 16 minutes.

How files are encrypted

• Each vault has a random 256-bit master key. Your pattern key and recovery key only "wrap" (encrypt) this master key.
• Files, thumbnails and the list of your items (original file names, dates, sizes) are encrypted with AES-256-GCM, using Android's built-in encryption. GCM also detects if a file was changed or swapped.
• Files inside the app have random names. Large files are encrypted in 1 MiB pieces, so videos play without ever writing a plain copy to storage.
• For JPEG photos, the hidden details (EXIF, such as camera and date) are stored separately, also encrypted.
• When the app locks, it overwrites the keys it holds in memory with zeros.

Recovery phrase

• When you create a vault, the phone's secure random number generator picks 9 English words. They come from two lists of 1,024 common words, in one of 4 fixed orders. That is 92 bits of randomness. The words are English in every language of the app.
• The phrase goes through the same Argon2id settings and unlocks the master key on its own. It does not need the device salt, so it works even when the pattern no longer does.
• A copy of the phrase is stored on the phone, encrypted twice: once with the master key and once with an Android Keystore key. You can see it in Settings after drawing your pattern again.
• When you change your pattern or use the phrase to get back in, you get a new phrase. The old one stops working.

Fingerprint

Fingerprint unlock is optional. Android checks the fingerprint, not SpaceMoon; the app never receives your fingerprint. A key in the Android Keystore that only works right after a strong biometric check unlocks the master key. If someone adds a new fingerprint to the phone, this key stops working and you must use your pattern again.

Backup file

• A backup is one .smb file. It holds your items exactly as they are already encrypted, plus two wrapped copies of the master key: one for the pattern you drew when you made the backup, and one for the recovery phrase you had then.
• The pattern copy uses a new random salt for each backup, not the device salt. That is what lets you open the backup on a new phone.
• The file's header is protected so that changes or swapped parts are detected.
• You choose where to save it with Android's own save screen. It never goes through us.
• To restore, open the file with its pattern or its phrase. You then draw a new pattern and get a new recovery phrase.

Other protections in the app

• Screenshots, screen recording and the preview in the recent apps list are blocked on every screen.
• By default, the app locks as soon as you leave it. You can choose 30 seconds or 1 minute instead.
• Android's own cloud backup and phone-to-phone transfer do not include SpaceMoon's data. Use the backup file instead.
• The app does not ask for location, contacts or "all files" access.

Limits you should know

No app can protect against everything. These are the honest limits of SpaceMoon.

Simple patterns can be guessed

Short or common shapes (an L, a Z, a straight line) can be guessed by watching you, by smudges on the screen, or in a few tries. Real patterns are much easier to guess than the number of possible patterns suggests. Use more dots and more turns. The app warns you about very simple patterns.

How long guessing could take

Inside the app, each try takes about a second, and waits grow after 5 mistakes. But someone who has your backup file, or who has taken the device salt from a rooted phone, can guess on a computer instead, with no waits. Argon2id slows this down, but a pattern has far fewer possibilities than a long password. Rough estimates for one high-end graphics card (RTX 4090 class) at about 1,000 guesses per second:

These are estimates, not measurements. Pattern counts are upper limits; real patterns are far fewer. More or faster hardware makes guessing faster in proportion.

Keep your backup file private

The backup file does not contain the device salt, so anyone who gets it can try patterns offline, as shown above. Store it only where you alone have access, such as your own cloud account, and use a longer pattern.

Rooted or infected phones

If someone can run code with the app's permissions (for example on a rooted phone, or with malware that has full control), they can unlock the device salt and guess offline. While the vault is open, keys are in memory and can be read with root access or a debugger. Some copies made inside Android and Flutter, and photos shown on screen, cannot be wiped from memory right away.

Some information is visible

The number of encrypted files in the app's storage, their rough sizes, and when they were created or changed are not hidden. Nor is the fact that SpaceMoon is installed.

The disguise only changes the home screen

• Only the launcher icon and name change. The phone's Settings > Apps list, app info and storage screens still show SpaceMoon.
• Screen readers may still say "SpaceMoon". For example, the Samsung One UI launcher gives TalkBack the real app name, and the app cannot change this.
• Android's share menu always shows the real app name, so SpaceMoon leaves it when you switch the icon. You can turn it back on.
• Android permission requests show the real name, so the app asks for permissions before you switch the icon.
• While the icon is changed, the app does not send notifications.
• The disguise code (4 to 8 digits) only shows the lock screen. It does not open your files. It is stored as a salted hash, but with so few possibilities it is easy to find if someone gets the file.

Fingerprint is a weaker path

Fingerprint unlock skips Argon2id. Its strength depends on your phone's fingerprint sensor and Android Keystore. You can turn it off in Settings at any time.

Intruder photos

The app does not play a shutter sound, but phones sold in some countries, such as Japan and Korea, always play one. No photo is taken if another app is using the camera or there is no front camera. Until you unlock the first vault you created, the photos are sealed with an Android Keystore key.

Photo details

• For HEIC, PNG and WebP photos, the hidden details (EXIF) stay inside the file. The whole file is still encrypted.
• On Android 10 and later, Android removes the GPS location from photos that SpaceMoon reads, because the app does not ask for location access. When the original is deleted from the gallery, that location is gone.
• Photos added through Android's photo picker get new names based on the date, because the picker does not give the original name.

Locking is paused during system screens

While a system screen is open (permission request, delete confirmation, photo or file picker, fingerprint prompt) and while an import or export is running, the app waits to lock. If you have left the app, it locks 2 seconds after that ends.

Vaults share one device salt

All vaults on a phone use the same device salt. If someone has that salt, one guess tests every vault at once. The cost to attack a single vault is the same.

Things no app can stop

Someone watching you draw your pattern, or a camera filming your screen.