Back up your vault, still encrypted
Save an encrypted copy of your vault to a place you pick, such as your Google Drive, and restore it on a new phone. Only your vault password or a recovery code can open it.
Backup is off until you turn it on.
How does the backup work?
Turn it on once, pick where the file goes, and Stillgarth keeps it up to date.
Step 1: Turn it on
Open Vault settings and choose Encrypted backup.
Step 2: Pick a place
Android's own "save to" screen opens. Pick where the file goes, for example your Google Drive.
Step 3: It stays current
Stillgarth refreshes the backup once a day, and whenever you tap Back up now.
Why can it run while the vault is locked?
Because it never decrypts anything. Your vault is already stored encrypted, so a backup is a copy of those encrypted pieces.
- Nothing is decrypted, and nothing readable is written anywhere.
- Stillgarth has no internet permission. The app you picked, such as Google Drive, does the uploading, under its own privacy policy.
- Back up now waits until the vault is locked, then runs.
- The daily backup waits until the battery and storage are not low.
- Only one backup runs at a time, and the saved size is checked after every write.
What opens the backup?
Your vault password, if it is at least 12 characters. Otherwise a 25-character recovery code, shown to you once.
The backup file could be copied and attacked away from your phone, so its copy of the key is protected with much heavier Argon2id settings: 128 MiB of memory and 4 passes.
The recovery code screen keeps the phone's screen on. You can copy the code (it is marked as sensitive) or, on Android 13 and newer, take a screenshot. The same code comes back until you confirm you have saved it, even after the vault locks.
How do you restore on a new phone?
Install the app, choose Restore from a backup, and unlock the file. Every file is checked before anything moves in.
Step 1: Install
On the new phone, install Stillgarth and open it.
Step 2: Pick the file
Choose Restore from a backup on the screen where you would create a vault, then pick the backup file.
Step 3: Unlock it
Type the vault password or the recovery code. With the recovery code, you also choose a new vault password.
Step 4: Checked first
Every file must decrypt before anything moves in. If some are too big for this phone's memory to check, it tells you how many and asks first.
Afterwards, set your PIN, fingerprint, duress code and backup again in Vault settings.
Restore only works on a phone with no vault. It never merges into or replaces a vault that is already there.
What is in the backup?
Everything you need to get the vault back, and nothing that is tied to the old phone.
In the backup
- Every file in the vault, still encrypted
- File names, folders and dates, in the encrypted database
- Guard photos that are already in the vault
- Your vault settings: auto-lock, screen-off lock and screenshot block. They are sealed with a key from the vault key, so an edited backup cannot loosen them.
Not in the backup
- Your PIN and fingerprint. They are tied to this phone's security chip.
- Your duress code.
- The backup settings themselves.
What happens to the backup if the vault is erased?
The saved file stays where it is.
Erasing the vault, by hand or with the duress code, forgets the backup settings on the phone but leaves the saved file alone. It also puts the vault settings back to their defaults.
If you no longer want the backup, delete it yourself from the place you saved it.
A lost phone doesn't have to mean lost files
Keep an encrypted copy somewhere you choose, and bring the vault back on your next phone.