Security / How your pattern becomes a key

How your pattern becomes an encryption key

Updated 2 November 2026 · By the FirstHour team

Short answerFirstHour doesn't save your pattern. Each time you draw it, your iPhone runs it through a slow calculation to produce a key. If the pattern is right, that key opens your Vault. If it's wrong, the key doesn't work, and FirstHour learns nothing else.

Step by step

You draw your pattern or type your PIN.
It's mixed with a random value, called a salt, made for your Vault. So the same pattern on two iPhones gives two different results.
It goes through 600,000 rounds of calculation. The method is called PBKDF2-HMAC-SHA256. On an iPhone this takes a fraction of a second.
Your iPhone's security chip adds its secret, where it can be. Here's what that does.
The result tries to open your Vault's key, which is stored only in locked form.

Why slow is good

You'd barely notice it when you open your Vault. Someone trying millions of guesses would, because every single guess has to pay that cost. OWASP, a respected web security group, recommends 600,000 rounds when this method is used. Its first choice for new password storage is a different method, Argon2id.

Why slow isn't enough on its own

A 6-digit PIN has only a million possibilities. If someone copied your Vault's files and its locked key to a fast computer, slowness alone wouldn't stop them trying them all. That's why FirstHour adds two more things:

The security chip, so guesses have to happen on your iPhone, where the chip is.
Waits after wrong tries. You get 4 free tries. After the 5th wrong try you wait 1 minute, then 5, 15 and 60, and 60 after each wrong try from then on. Waits can run longer while your iPhone is asleep. Wrong tries are forgotten only after a whole day without one.

What it can't fix

An easy pattern is still easy. The calculation slows guessing, but it can't make a simple shape less obvious.
Someone can watch you. No calculation helps if a person sees you draw it. Shield your screen.
Forgetting has a price. Because the pattern isn't stored, nobody can look it up. You'd need your recovery phrase.

Questions

Where is the key stored?

Your Vault's key is stored on your iPhone in locked form, sealed by the key made from your pattern or PIN, and separately by a key made from your recovery phrase. Each backup file also holds it, sealed by your phrase. It's never stored in a readable form.

Does FirstHour know if my pattern is simple?

It checks the basic rules: on the 5×5 grid, at least 6 dots with at least one turn. It can't tell whether you've picked something someone could guess, so avoid initials and obvious shapes.

Sources

Password Storage Cheat Sheet, OWASP