Security / The Secure Enclave

What the Secure Enclave does for your Vault

Updated 2 November 2026 · By the FirstHour team

Short answerThe Secure Enclave is a part of your iPhone's chip that's kept apart from everything else, for handling secrets. Where it can be, FirstHour ties your pattern or PIN to it. So even if someone copied your Vault's files and its locked key to a computer, they couldn't try patterns or PINs there.

What it is

Apple describes the Secure Enclave as a dedicated security subsystem, isolated from the main processor. Think of a small safe built into your iPhone. Apps can ask it to do a job with a key inside, but they can't take the key out.

What problem it solves

Imagine someone uses special data-recovery tools to copy the Vault's files and its locked key off your iPhone. Without the chip, they could try every 6-digit PIN on a fast computer, in under an hour, with none of the app's waits in the way.

With it, the key that opens your Vault needs a secret that only your iPhone's chip can produce. Off your iPhone, that secret isn't available, so pattern and PIN guessing can't start.

How FirstHour uses it

The chip makes a key that never leaves it. FirstHour keeps only an encrypted reference, useless on any other device.
Each time you unlock, the chip produces a secret from that key.
That secret is combined with the key made from your pattern or PIN. Both are needed.

The Vault's screen shows "Secure Enclave" only when your Vault is really tied to the chip. If it isn't, the line leaves those words out.

What it can't do

It doesn't do the scrambling. The chip protects the way into your Vault. The pictures themselves are unscrambled by the app while the Vault is open.
It doesn't cover your recovery phrase or backup file. The phrase opens the Vault without the chip, and a backup is made to open on another iPhone, so your phrase alone protects them. That's why it has to be hard to guess.
It can't stop someone who knows your pattern and has your iPhone.
It ties your Vault to this iPhone. If you lose the phone, the Vault goes with it, unless you saved an encrypted backup.

Questions

Does this mean guessing is impossible?

No. For someone using FirstHour, guesses have to be made on your iPhone, one at a time, with FirstHour's waits in the way. A simple pattern could still be guessed, and a hacked iPhone is a different story.

Is my Vault tied to Face ID?

No. The Vault opens with your pattern or PIN. Here's how those compare.

Sources

The Secure Enclave, Apple Platform Security