NullKey 
Scrambling plus a key
Encryption turns readable data into scrambled data that is useless without the right key. On a phone, encryption at rest means the stored data is scrambled on the storage itself, so reading the raw storage gives nothing useful without the key. Encryption is one layer among several, and it is not a substitute for locking your phone.
The key is the part that decides the outcome. A strong method with a key nobody else has protects your data, while the same method with the key stored beside the file protects very little. Good encryption depends as much on key handling as on the scrambling. Think of the key as the thing you protect, and the file as the thing the key unlocks.
Keys that protect other keys
Well-designed systems rarely encrypt everything with one key. Each item can have its own key, and those keys are locked with a master key. Changing a passphrase can change how the master key is locked, without rewriting every file behind it.
Authenticated encryption also checks integrity. If a file has been altered or cut short, decryption is designed to report an error rather than quietly return damaged data. Those checks run when the file is read, so they add protection without an extra step for you.
What encryption does not stop
Read this list as the boundary of any encryption you use, not as a reason to avoid it. Each item on it is a route around encryption rather than through it.
- Someone using your unlocked phone, who can see what the screen shows.
- A readable copy you export, which the app no longer encrypts.
- Copies made by other apps, cloud services or clipboard managers.
- Malware or a compromised operating system while your data is open.
- Old copies left behind when you delete, since removal is not a secure erase.
How NullKey handles this
NullKey protects stored contents with AES-256-GCM. Each item has its own random key, wrapped by a random 256-bit vault master key, and that master key is protected by a key Argon2id derives from your passphrase. The index and key wrappers use authenticated encryption, so tampering is detected.
Limit: this protects data at rest inside the vault. While the vault is unlocked, readable data is processed in memory, and file counts, approximate sizes, thumbnail presence and filesystem times are not hidden. Replacing files with an older copy of the same vault is not detected.
A plain test for any app
When an app says a file is encrypted, ask what is encrypted, where the key is kept, what happens if the secret is lost, and whether readable copies appear along the way. Those four answers matter more than a label such as strong or secure. If an app cannot say where its key is made and kept, treat its other claims with caution.
Be wary when the answer to the second question is a company server, because that may mean someone other than you can unlock your files. Also ask whether a backup made by the app is encrypted too, since a protected vault with a readable backup is only as safe as the backup.
