# Passwords and additional protection

> Understand what your vault needs to open and choose a protection option you can maintain.

Document ID: phantom-help:phantomvault/passwords-protection
Product: PhantomVault
Platforms: macOS and iOS
Updated: 2026-11-02
Availability: Preview-build instructions.
Tested app version: Not recorded
Tested build: Not recorded
Tested OS version: Not recorded

Source: https://llms.phantomsecure.app/phantomvault/passwords-protection.md
Human guide: https://phantomsecure.app/help/phantomvault/passwords-protection/
Agent guide: https://llms.phantomsecure.app/phantomvault/passwords-protection/
Documentation index: https://phantomsecure.app/llms.txt
Full handbook: https://phantomsecure.app/llms-full.txt

## Your vault password or passphrase

Mac calls it a **Passphrase**; iPhone and iPad call it a **Password**. Both are the secret for a password-based vault and require at least 12 characters at creation. Keep it in a safe place separate from the vault file.

To open, select the vault and enter that secret in its unlock screen. Capitalization and the characters you enter matter. App Access, Face ID, a device passcode and the PhantomCal opening secret do not change the vault password.

There is no vault-password reset that recovers the encrypted contents. A backup of the vault file still needs its credentials.

## Additional Protection on Mac

Choose this during creation:

| Choice | What is also required | Portability |
| --- | --- | --- |
| **None** | No extra custody key beyond the chosen unlock method. | The file still uses synchronized freshness checks when opened on another device. |
| **This Mac** | A key bound to this Mac's Secure Enclave. | The vault remains bound to that Mac. Losing, erasing or replacing it can make the vault inaccessible. |
| **iCloud** | Its additional key in iCloud Keychain. | Other supported devices need that key to have synchronized before opening. |

**This Mac** does not mean “require Touch ID on every open.” [Touch ID enrollment](https://phantomsecure.app/help/phantomvault/touch-id-mac.txt) is a separate control.

## Require iCloud Keychain on iPhone and iPad

The creation form's **Require iCloud Keychain** switch is the additional iCloud custody option. It protects key access; the vault file remains in the **Save Location** you choose. Selecting an iCloud Drive folder and enabling iCloud Keychain are separate decisions.

A vault created with **This Mac** protection cannot be made portable by copying its file to an iPhone. Use a different vault created with protection appropriate to the devices you need.

## If a key or freshness checkpoint is missing

Sign in to the expected Apple Account and allow iCloud Keychain to synchronize. The app also needs the current freshness checkpoint for the vault, including for a vault without optional iCloud custody. An encrypted file arriving through Files does not prove that its key state has arrived.

Do not delete Keychain entries or replace newer copies while investigating. Preserve the complete carrier and the device that can still open it. See [backup and transfer](https://phantomsecure.app/help/phantomvault/backup-transfer.txt) and [troubleshooting](https://phantomsecure.app/help/phantomvault/troubleshooting.txt).

## What these options do not provide

The current standalone interfaces do not offer recovery codes, a forgotten-vault-password reset, or decoy-vault creation. Adding a security key for **App Access** does not add that key as a spare credential for an existing vault.