Self-Destruct: Vaults Erase After Too Many Wrong Signs

Self-destruct is included in sigil. for free, off by default. When you turn it on and someone draws too many wrong signs within a time window, your vaults are erased: keys and photos are destroyed and the app goes back to looking freshly installed. In the app we put it in one line: if someone keeps guessing, the vault is gone before they get there.

How it works

1. Open Settings inside sigil. and turn on self-destruct.
2. Choose the threshold and the time window. The default is 50 wrong signs in 24 hours; you can raise or lower it.
3. From then on, every wrong sign counts. Between attempts sigil. enforces growing waits: 30 seconds, then 1 minute, then 5 minutes. With the defaults it takes about three and a half hours of guessing to reach 50.
4. If the threshold is reached within the window, sigil. erases the vaults. The keys are destroyed, and without the keys the encrypted data can no longer be read.

The person guessing gets no warning and sees no counter. They don't know how far along they are, or whether self-destruct is even on. All they see is a dot grid and waits that keep getting longer.

When you unlock with the right sign, the count resets to zero. A few absent-minded mistakes over a week don't add up.

Why it exists

Each vault is encrypted with a 256-bit key that only its sign can unlock (see pattern encryption). Nobody has the key, not even us, and there's no back door. That means the only way in without knowing the sign is to guess it.

The growing waits already slow guessing down. Self-destruct adds a ceiling: after a certain number of mistakes, there's nothing left to guess. With self-destruct off, a guesser only gets ever-longer waits; with it on, at some point they find an empty app.

A well-chosen sign makes all of this work better. Check yours with the pattern strength meter: a sign that's hard to guess and a sensible threshold work together.

When it helps

• A lost or stolen phone. Whoever has it, and has time to spare, can try signs for hours. With self-destruct on, sooner or later the vaults are gone. See lost or stolen phone and our guide on how to protect photos if your phone is stolen.
• Someone with access to your phone when you're not around, for example at home, trying patiently while you're out.
• When you'd rather lose the photos than have someone else open them. For some photos that's the right call, for others it isn't. You decide.

What to know before turning it on

• Keep your recovery phrase anyway. It's what gets you back in if you forget a sign, as long as the vaults exist. It doesn't help after a self-destruct.
• There's no cloud backup. sigil. is local-first: your photos stay on the phone. Irreplaceable photos should also be stored somewhere else, securely. Our guide on how to securely back up private photos covers the options.
• A forensic copy is a different fight. Someone who copies the encrypted files off the device can't guess your sign against that copy: the key is bound to the phone's secure chip, so guessing has to happen on the phone itself, where the growing waits and self-destruct apply. What remains is the encryption and the strength of your sign.
• A child can trigger it. A child playing with the phone and tapping the grid for hours can rack up mistakes. The growing waits slow that down a lot, but if there are kids at home, choose a higher threshold or a shorter window. See kids with your phone.
• You can make mistakes too. If you tend to forget signs, don't set the threshold too low. The default leaves plenty of room.

Self-destruct or decoy vault

They're two different features, and you can use both.

The decoy vault is for when someone forces you to open the app: you draw the decoy pattern, the decoy opens, nothing is erased and your real vault stays hidden. Self-destruct is for when you're not there, or you're not the one drawing.

Tips

1. Before you turn it on, back up irreplaceable photos separately.
2. Write your recovery phrase on paper and keep it away from the phone.
3. Start with the default (50 in 24 hours) and change it only if you have a specific reason.
4. Use signs that are clearly different from each other, so you don't rack up mistakes by mixing them up.
5. If the phone often ends up in kids' hands, raise the threshold.

Plans

Self-destruct is free, like every feature: decoy vault and disguised icon included. sigil. Pro only adds space: unlimited photos and videos and up to 7 vaults, each with its own pattern. Details are on the pricing page.