Locked means locked. Even we can’t open it.

When you lock a document in Tripkosh, your phone scrambles it before it is uploaded. We store the scrambled copy. The key that unscrambles it stays with you.

Passports, visas and IDs you add to your vault are locked by default, and you can lock anything else with one switch. This page explains what that actually means, in plain words first and in detail at the end.

What happens when you lock a document

1. Your phone makes the key. The first time you open the vault, the app creates a random key on your phone and keeps it in the phone’s secure storage. When your phone has fingerprint or face unlock, the vault asks for it before it opens.
2. Each document is scrambled on your phone, with its own key, before anything is uploaded.
3. We store only the scrambled file. Without your key it is meaningless, to us, to our hosting provider, and to anyone who ever broke into our servers.
4. Opening it happens on your phone too. The app downloads the scrambled file, unlocks it in the phone’s memory and shows it to you.

Locked documents are never read by our software, never sent to AI services, and never shared with anyone.

If you lose your phone

When you set up your vault, the app shows you a recovery code: 24 letters and numbers, like F7KM-2QWX-9RTV-HJ3N-P5ZC-8BDE. We keep one backup of your key on our servers, locked with that code. The code is made on your phone and is never sent to us.

On a new phone, you sign in and type the code, and your documents open again. Nobody can guess it: if a billion computers each tried a billion codes every second, it would take them billions of years, and the app deliberately makes every single try slow.

• Keep the code somewhere other than your phone: a password manager, or written down at home. The app’s “Save or share” button helps.
• Moving to a new phone, or lost the code? On your old phone, tap “New recovery code” in the vault. The old code stops working straight away.
• Lost both your phone and your code? Then your locked documents can’t be recovered, by you or by us. That is the price of us not being able to open them. You can start a new vault and add them again.

What locking doesn’t cover

We’d rather you hear the limits from us.

• Titles and basic details. A document’s title, type (passport, visa and so on), the date you added it and its file size are stored readable, so your list loads before you unlock it. Don’t put your passport number in a title.
• Documents you leave unlocked. Tickets and booking confirmations are usually left unlocked, so Tripkosh can read them and fill in your itinerary. How that works is in our privacy policy. Lock any document to keep it out.
• Your phone itself. Anyone who can unlock your phone can open your vault. Use a screen lock, and fingerprint or face unlock.
• Files you share out. When you open a locked PDF in another app or send it to someone, that app gets the normal file. Tripkosh deletes its own temporary copy afterwards.
• The app you install. The locking happens inside the Tripkosh app, so it is only as trustworthy as the app. Get it only from Google Play or the App Store.

The technical details

For anyone who wants to check our work:

• Each file is encrypted on the device with AES-256-GCM under its own random 256-bit key. That file key is encrypted with your 256-bit master key and stored next to the file.
• The master key is generated on the device and kept in the Android Keystore or iOS Keychain. When fingerprint or face unlock is set up, the key can only be read after that check, and the vault asks for it again after five minutes.
• The recovery code is 24 symbols chosen uniformly at random on the device from a 30-symbol alphabet (no lookalikes such as 0/O or 1/I), about 117 bits.
• The server backup is your master key encrypted with AES-256-GCM under a key derived from the recovery code with Argon2id (64 MB of memory, 3 passes, random salt).
• The server also stores a SHA-256 hash of the master key, so the app can tell a correct recovery code from a wrong one. A hash cannot be turned back into the key.
• Everything travels over HTTPS, and attempts to fetch the backup are rate-limited.

Last updated 23 October 2026. Found something wrong, or a weakness we’ve missed? Write to [email protected].