Security concepts

What is Secure Enclave and Android Keystore?

Secure Enclave and Android Keystore are platform security facilities involved in protecting cryptographic operations or key material; they are not interchangeable names for an encrypted photo vault.

· September 7, 2026

Secure Enclave and Android Keystore are platform security facilities involved in protecting cryptographic operations or key material; they are not interchangeable names for an encrypted photo vault.

Two platforms, different facilities

Apple describes the Secure Enclave as an isolated security subsystem. Android's Keystore documentation describes key storage, authorized key use, and hardware-backed security options. Hardware support and key properties vary by device and configuration.

An application saying that it uses a platform security API does not mean all of its files are physically stored inside a separate chip. Large media files and their encryption keys have different storage and processing needs.

Questions worth asking

Which key is protected? Can it be exported? What authentication is required for its use? What happens when a device is reset or replaced? Are portable backups designed around a different recovery secret? These questions determine practical behavior more clearly than a general hardware-security badge.

Platform protection also does not make every use of an unlocked application safe. If an attacker controls the running operating system, plaintext displayed by the application may be exposed even when a particular key cannot be extracted directly.

NullVault's documented use

The Android architecture describes Keystore material alongside Argon2id and encrypted app storage. The iOS architecture has its own cryptographic and recovery design. Do not infer undocumented Secure Enclave storage from the fact that an app runs on an iPhone. Read NullVault's architecture, device-compromise limitations, and how encrypted vaults work.