Some things aren't meant for the cloud.
Fixative is an encrypted vault for your photos and videos. Everything is sealed on your device with keys only you hold — no account, no server, nothing to leak.
Protection that assumes the worst.
Built for the moments when a locked phone isn't enough — a borrowed device, a border crossing, a lost backup.
Two-tier unlock
PIN or Face ID browses thumbnails; a separate passphrase reveals full-resolution originals. A glance never exposes everything.
On-device encryption
XChaCha20-Poly1305 seals every photo and video, with keys locked in the Secure Enclave. No cloud, no account, nothing to leak.
Recovery without a company
Shamir secret sharing splits your key into printable word-list shares. Any 3 of 5 rebuild it — even if you lose every device.
Duress PIN & decoy vault
A second PIN opens a harmless decoy for the moments you are forced to unlock. Your real library stays sealed and hidden.
Peer-to-peer sync
Keep devices in sync over your own local network — direct, encrypted, with no server sitting in the middle.
A glance never exposes everything.
Two independent locks stand between the world and your originals. Getting past the first only shows you shadows.
PIN or Face ID
Fast access to blurred thumbnails so you can find what you need. Enough to navigate, never enough to expose.
Full passphrase
A separate, stronger secret decrypts the original files. Required every time you open a full-resolution photo or video.
What we can see: nothing.
Fixative has no servers, no accounts, and no telemetry. Your library is encrypted before it ever touches storage, with keys that never leave the Secure Enclave.
There is no password reset, because there is no one to reset it. That's the point.
Buy it once. Own it forever.
No subscription — there's no server to pay for. One purchase, unlocked on every device you own.
Fixative
Everything you need to seal one device.
Fixative Pro
For everything you own — unlocked once, forever.
The honest answers.
What happens if I forget my passphrase?
Nothing can be done from our side — we have no keys and no way to reach your vault. That is exactly why recovery shares exist: print them, split them, and store them somewhere safe. Three of your five shares rebuild the key.
Is anything ever uploaded to a server?
No. Fixative has no backend at all. Encryption, storage, and unlocking all happen on your device. Sync, when you enable it, is peer-to-peer over your local network.
How does the duress PIN work?
You set a second PIN that opens a decoy vault filled with whatever harmless content you choose. If someone forces you to unlock, you hand over the decoy PIN — your real library stays sealed and invisible.
What encryption does Fixative use?
Every photo and video is sealed with XChaCha20-Poly1305. Keys are generated and stored in the Secure Enclave and never leave it in plaintext.
Can I move my vault to a new phone?
Yes. Local peer-to-peer sync transfers your encrypted library device-to-device, and your recovery shares let you restore even if the old device is gone.
Do you collect any analytics?
None. No telemetry, no crash pings tied to you, no account, no email. There is nothing to collect because nothing leaves your device.
Keep what's private, private.
Fixative is free to try on one device. Download it and seal your first vault in under a minute.
Download on the App Store