Your vault password or passphrase
Mac calls it a Passphrase; iPhone and iPad call it a Password. Both are the secret for a password-based vault and require at least 12 characters at creation. Keep it in a safe place separate from the vault file.
To open, select the vault and enter that secret in its unlock screen. Capitalization and the characters you enter matter. App Access, Face ID, a device passcode and the PhantomCal opening secret do not change the vault password.
There is no vault-password reset that recovers the encrypted contents. A backup of the vault file still needs its credentials.
Additional Protection on Mac
Choose this during creation:
| Choice | What is also required | Portability |
|---|---|---|
| None | No extra custody key beyond the chosen unlock method. | The file still uses synchronized freshness checks when opened on another device. |
| This Mac | A key bound to this Mac's Secure Enclave. | The vault remains bound to that Mac. Losing, erasing or replacing it can make the vault inaccessible. |
| iCloud | Its additional key in iCloud Keychain. | Other supported devices need that key to have synchronized before opening. |
This Mac does not mean “require Touch ID on every open.” Touch ID enrollment is a separate control.
Require iCloud Keychain on iPhone and iPad
The creation form's Require iCloud Keychain switch is the additional iCloud custody option. It protects key access; the vault file remains in the Save Location you choose. Selecting an iCloud Drive folder and enabling iCloud Keychain are separate decisions.
A vault created with This Mac protection cannot be made portable by copying its file to an iPhone. Use a different vault created with protection appropriate to the devices you need.
If a key or freshness checkpoint is missing
Sign in to the expected Apple Account and allow iCloud Keychain to synchronize. The app also needs the current freshness checkpoint for the vault, including for a vault without optional iCloud custody. An encrypted file arriving through Files does not prove that its key state has arrived.
Do not delete Keychain entries or replace newer copies while investigating. Preserve the complete carrier and the device that can still open it. See backup and transfer and troubleshooting.
What these options do not provide
The current standalone interfaces do not offer recovery codes, a forgotten-vault-password reset, or decoy-vault creation. Adding a security key for App Access does not add that key as a spare credential for an existing vault.