ChipVault
iPhone · NFC · One-time purchase

A hardware vault for your secrets.

Turn NXP DESFire EV2 or EV3 NFC cards into encrypted personal vaults. Store passwords, codes, recovery phrases, and notes directly on hardware you carry in your wallet. No cloud, no servers, no accounts, no subscriptions.

App Store · coming soon How it works

What ChipVault does

Eight categories. One master password. Every byte AES-128 encrypted on the chip.

Eight category vaults
Financial, Medical, Travel, Auto, Insurance, Tools, Credentials, Licenses. Each is its own DESFire application with independent key material.
Chipset-native AES-128
EV2 Secure Messaging end-to-end. Keys derived from your master password + the card's unique UID. The chip enforces it at the silicon level.
Storage donut
A visual map of every byte used and free on each card, per category. Know at a glance whether you're at 12% or 92%.
Clone to a backup card
Byte-for-byte replication onto a second ChipVault-personalized card. Your safety net stays in your physical control, never anyone's cloud.
Tap to read, tap to write
Hold a card to your iPhone. Enter your master password. Done. No QR codes, no Bluetooth pairing, no setup wizards.
Reset to factory
A one-tap erase returns any card to blank-from-factory state — useful for repurposing, gifting, or just starting over.

How it works

Three steps from blank card to populated vault.

1
Set your master password
On first launch, choose a strong master password. ChipVault never transmits or stores it. It only lives in your head and (briefly, when you unlock) in your iPhone's Secure Enclave.
2
Personalize a blank DESFire card
Tap a blank NXP DESFire EV2 or EV3 card to your iPhone. ChipVault writes the eight category structures, derives a unique key for each category from your master password + the card's UID, and replaces the factory keys with yours.
3
Store and retrieve
Add entries into any category — passwords, account numbers, recovery phrases, notes. Tap the card to read. Tap again to write changes. Make a backup card whenever you want a safety net.

Frequently asked questions

If something isn't covered here, just email — we read everything.

What cards do I need?
Any NXP DESFire EV2 or EV3 card. Common sizes are 2K, 4K, or 8K of EEPROM. They're available from most NFC suppliers online and typically cost a few dollars per card. ChipVault works with all sizes — the storage donut will reflect what your specific card has.
What if I forget my master password?
Your data is not recoverable. ChipVault never transmits or stores your master password, and the encryption keys are derived from it. This is a deliberate trade-off — strong privacy means no recovery backdoor. Write your master password down somewhere safe (a sealed envelope in a fireproof safe is a classic option) before you commit anything important to a card.
What happens if I lose a card?
Whoever finds it cannot read its contents without your master password. The card stores only ciphertext. If you've made a backup card, you still have your data. If you haven't, that data is gone — same as losing a paper notebook. We recommend cloning to a backup card and storing the backup in a separate physical location.
Does ChipVault sync to iCloud?
Your actual stored entries live on the NFC cards themselves, not in iCloud. ChipVault does store a small amount of operational data in your iOS Keychain — specifically the install date (for trial state) and references to which cards you've personalized — and that small set syncs via iCloud Keychain so your trial state and known-cards list survive a device migration. iCloud Keychain is end-to-end encrypted by Apple; we have no access to it.
Is there a subscription?
No. ChipVault is a single one-time purchase that unlocks the app forever on all your devices via Family Sharing. A 20-day free trial lets you try everything before buying. We will never add a subscription tier.
What iPhones are supported?
iPhone 7 or later, running iOS 17 or later. Core NFC's NFCTagReaderSession API is required for direct DESFire APDU communication.
Can I use ChipVault on my iPad?
Not currently. iPads don't have the NFC reader hardware required for Core NFC tag sessions. ChipVault is iPhone-only by necessity.
What about Android?
There's no Android version today. ChipVault is currently an iOS-only product. If you'd find an Android version valuable, let us know — interest weighs into our roadmap.
Is ChipVault open source?
Not at this time. ChipVault is closed-source commercial software. All cryptographic operations use Apple's built-in CommonCrypto and Core NFC frameworks — no custom rolled crypto.
Can I read my ChipVault card with a non-ChipVault tool?
Technically yes, but you'll see only ciphertext. ChipVault uses standard DESFire EV2 application structures, so any NFC tool can probe the card and see that eight applications exist — but every file on those applications is AES-128 encrypted with keys derived from your master password. Without the password, the data is unintelligible.

Need help? Found a bug? Have a feature request?

ChipVault is built by an indie shop. Every email is read by a human (Nagi). Typical response: same day.