Encrypted Vault
The vault is a locked room inside Omni for the things you don’t want lying around — encrypted at rest, opened only by you.
What lives in the vault
- Saved pages — keep a private copy of a web page.
- Images — save downloads straight to the vault.
- Dev Notes — an offline scratchpad for sensitive text.
Open it
Quick Tools → Vault, or navigate to it from the menu. You’ll authenticate with your fingerprint, face or PIN. The vault locks again when you leave it.
How it’s encrypted
| Data | Mechanism | Key storage |
|---|---|---|
| Vault database | SQLCipher (AES-256) | Derived, Keystore-backed |
| Vault files | EncryptedFile (AES-256-GCM) | Android Keystore (hardware) |
Nothing is ever written to disk in plaintext. Even with physical access to your phone’s storage, the vault is unreadable without your biometric.
Saving to the vault
When you download an image or save a page as PDF, the dialog offers two destinations: Downloads (public, visible to other apps) or Private Vault (encrypted). Choose the vault for anything sensitive.
The vault relies on Android’s biometric/PIN. If your device has no screen lock, set one up — the vault is only as strong as your lock screen.