Which encryption method does SimpleumSafe use?

Short answer: AES-256

SimpleumSafe protects your Safe data with AES-256, an internationally established encryption standard. It protects not only file contents, but also file names, dates, tags, and the encryption keys required to access them.

A strong Safe password, a protected and up-to-date device, and a securely stored recovery password are also important for your security.

What AES-256 protects in SimpleumSafe

SimpleumSafe stores different kinds of protected information in separate encrypted areas. This protects not only your documents and photos, but also information that could already reveal something about their contents.

An open digital vault shows three AES-256-protected areas for file contents, metadata, and encryption keys.
AES-256 protects three essential areas in the Safe: file contents, descriptive file information, and the encryption keys required to access them.

File contents

Documents, photos, and other files are stored in encrypted form inside the Safe.

File information

File names, dates, tags, and other metadata are kept in an encrypted database.

Encryption keys

The keys for files and metadata are themselves stored in a protected Safe key file.

What this means for you

  • File names and tags remain protected too. An unopened Safe does not reveal which documents it contains through its file list.
  • Your Safe password is not stored. It is used to unlock the protected key file.
  • Simpleum Media does not know your password. Without the Safe password or a recovery password that was set up in advance, the company cannot restore access.

AES-256 is an important part of the protection. The overall security of a Safe also depends on the implementation, the strength of the Safe password, and the security of the device where the Safe is opened.

What you can do

  1. Use a long, unique Safe password that you do not use for other services. See SimpleumSafe security for further guidance.
  2. Set up a recovery password while you still have access to the Safe: instructions for Mac and instructions for iPhone and iPad.
  3. Keep SimpleumSafe and the operating system up to date, and protect your device with a strong device passcode or password.

Technical details for interested readers

According to the SimpleumSafe Technical White Paper, the three areas use the following components:

  • File data: RNCryptor V3 with AES-256 in CBC mode.
  • File information: an encrypted SQLCipher database using AES-256.
  • Safe key file: an encrypted file containing the randomly generated keys for file data and the database.

Security operations and key management are handled by the Simpleum®Cryptor. The Technical White Paper describes the encryption keys as inaccessible outside that component.

AES is the Advanced Encryption Standard specified by the US National Institute of Standards and Technology, or NIST. AES supports 128-, 192-, and 256-bit keys; SimpleumSafe uses the 256-bit variant.

More information