ChipVault
v2.0 · Now on the App Store · iPhone · NFC

Data Secured. On your Card. In your Pocket.

ChipVault is the only iOS app dedicated to managing your data on NXP DESFire EV2 / EV3 cards. Turn a blank card into a hardware-backed personal vault for passwords, codes, recovery phrases, and notes — stored on the chip itself. No cloud, no servers, no accounts, no subscriptions.

New in v2.0: the card itself carries an encrypted Self-Manifesto — re-pair any personalized card to a new phone with just your master password.

Download on the App Store ▸ Watch the v2.0 demo See it in action How it works

▸ The v2.0 walkthrough — Self-Manifesto, recovery to a new phone, and the V2 architecture, in a few minutes.

What ChipVault does

Up to 8 categories per card. One master password. Every byte AES-128 encrypted on the chip.

Self-Manifesto recovery New in 2.0
Every personalized card carries an encrypted recovery slot of its own — the Self-Manifesto. Lose your phone, switch to a new one, hand the card to a future-you a decade from now: tap the card, enter the master password, the vault rebuilds itself. No cloud account. No backup file. No support ticket. The card is the source of truth.
Sync to Card New in 2.0
Edit entries on your phone, then write your changes back to the chip with a single NFC tap. Each sync uses fresh cryptographic state so your data stays sealed end-to-end.
Flexible category vaults
Pick up to 8 categories per card from a palette of 15+ pre-canned options (Financial, Medical, Travel, Auto, Insurance, Tools, Credentials, Licenses, Subscriptions, Crypto Recovery, Family, Work, Notes, Wi-Fi & IoT, Personal IDs) or roll your own with custom names. Each is sealed off with its own independent keys at the chip level.
Chip-level AES-128
Industry-standard AES-128 encryption applied at the chip level. The chip enforces key separation between categories at the silicon level.
Edit your cards anytime
Rename a card, switch its theme or icon, rename any category — all instant, no NFC tap needed. Your structural choices stay flexible long after personalization.
Add & delete categories
Need a new category on a card you've already personalized? Tap to provision. Done with one? Swipe-delete to wipe it. Each operation is one NFC tap with a clear confirmation step.
Storage donut
A visual map of every byte used and free on each card, per category. Know at a glance whether you're at 12% or 92%.
Backup with carry-over toggles
Clone an entire card to a second ChipVault-personalized card. Choose per-trait what carries over to the destination — name, theme, icon. Your safety net stays in your physical control, never anyone's cloud.
Tap to read, tap to write
Hold a card to your iPhone. Enter your master password. Done. No QR codes, no Bluetooth pairing, no setup wizards.
Reset to factory · Reset & Restructure
A one-tap erase returns any card to blank-from-factory state. And if a chip's memory allocator ever gets stuck after many delete/add cycles, Reset & Restructure wipes and rebuilds it with your existing category set — a fail-safe you'll rarely need but will be glad is there.

Secure by Design. Secured by Default. Secured in Operations.

ChipVault treats security as three substantiated commitments — not a marketing slogan. Each pillar is backed by specific architectural choices baked into the product, not a configuration the user has to remember to enable.

Pillar 1
Secure by Design
  • All cryptography handled by Apple's built-in audited frameworks. No custom-rolled crypto. No third-party crypto libraries.
  • Industry-standard AES-128 encryption at the chip level, with per-category key separation.
  • The chip enforces key separation at the silicon level — each category is sealed off from the others.
  • Your master password is never transmitted, never stored on disk. It lives only in your head and, briefly, in the iPhone's secure hardware.
Pillar 2
Secured by Default
  • Cards are personalized with your keys before any of your data is written. No “configurable insecurity” state.
  • Every personalized card carries an encrypted Self-Manifesto — the on-chip recovery record that lets the same master password rebuild the vault on a new iPhone with no backend involvement.
  • iCloud Keychain holds only trial state and known-card metadata — small and non-sensitive. Vault contents never leave the chip.
  • No analytics SDKs. No telemetry. No ad networks. The app talks to your card, your Keychain, and nothing else.
  • Closed-source today, with all cryptography handled by Apple-audited frameworks.
Pillar 3
Secured in Operations
  • Fresh cryptographic state for every NFC interaction. No long-lived sessions on the chip or in the phone.
  • Write paths are confirmation-gated with explicit UX — no silent NFC writes, no surprise overwrites.
  • Reset & Restructure recovery path handles rare edge cases without exposing your data.
  • Backup is via on-card cloning to a second card — never via cloud upload, never via file export. Physical possession stays the trust boundary.
  • Lose your phone? Tap any of your cards to a new iPhone, enter the master password — the vault rebuilds. Forget the master password? Data is unrecoverable. Deliberate. No backdoor.

See it in action

A look at the v2.0 interface — your cards, beautifully organized.

ChipVault About panel showing v2.0.0 build 1 and the tagline 'Your data, on your card, in your pocket'
Aboutv2.0.0 — your data, on your card, in your pocket. Privacy, support, and quick links live in one place.
ChipVault card shelf showing the source card and its backup card side-by-side, each with matching 49% used storage donuts and identical 6-category layouts
Your card shelfSource card and backup card on the same shelf, matching byte-for-byte. Themes, storage donuts, and backup state — all in a glance.
ChipVault card detail page showing a storage donut at 51% free, per-category byte legend, system overhead, and a Back Up This Card button
Card detailSee exactly how every byte is allocated across categories, system overhead, and free space.
ChipVault Edit Card sheet showing name, theme picker, icon picker, and category list with swipe-to-delete affordance on Loyalty
Edit CardRename, retheme, change icons, swipe-delete categories — no NFC tap. Sync to Card commits changes to the chip.
ChipVault Self-Manifesto screen showing card identity, enrollment provenance, last updated info, last backup state, and category list
Self-Manifesto New in 2.0The encrypted on-chip recovery record. Provenance, last writes, last backup — any phone with ChipVault can re-pair this card.
ChipVault Card Scanner screen prompting the user to hold a DESFire EV2 or EV3 card to the iPhone, with an inline message explaining a factory-blank card and New Card / Read Card actions
ScanHold any DESFire EV2/EV3 card to your iPhone. ChipVault recognizes its Self-Manifesto and re-establishes the link — or enrolls a factory-blank card from scratch.
ChipVault Card Personalized success screen with a green check, confirmation that the card is ready to use with 7 categories, and a Ready-to-Scan modal in the foreground
Card personalizedThe secure-by-default moment. Factory keys replaced, your master-password-derived keys committed, the card is now yours.
ChipVault Select destination screen showing 'Which card should hold the backup?' with a matching EV2 8K destination card listed, and explanatory text that the destination will be erased and rebuilt to mirror the source
Select destinationPick the second card to mirror to. ChipVault shows only DESFire EV2 / EV3 cards that match the source's capacity — no accidental cross-pairing.
ChipVault Backup complete screen with green check, source and destination cards shown linked, suggested storage locations including safety deposit box and fireproof home safe, and confirmation that the backup pointer has been recorded on the source card's Self-Manifesto
Backup complete New in 2.0Source and backup linked. Suggested storage — deposit box, fireproof safe, trusted family. The Self-Manifesto records the backup pointer; audit without exposure.

How it works

Three steps from blank card to populated vault — and a fourth if life ever hands you a new phone.

1
Set your master password
On first launch, choose a strong master password. ChipVault never transmits or stores it. It lives only in your head — and briefly, when you unlock, in your iPhone's secure hardware.
2
Personalize a blank DESFire card
Tap a blank NXP DESFire EV2 or EV3 card to your iPhone. Pick up to 8 categories from a palette of pre-canned options (Financial, Medical, Travel, Auto, Insurance, Tools, Credentials, Licenses, Subscriptions, Crypto Recovery, Family, Work, Notes, Wi-Fi & IoT, Personal IDs) or roll your own custom names. ChipVault personalizes the card with your master-password-derived keys, replacing the factory keys before any of your data is written.
3
Store, retrieve, and adjust
Add entries into any category — passwords, account numbers, recovery phrases, notes. Tap the card to read. Tap again to write changes. Edit the card's name, theme, icon, or category names anytime without an NFC tap. Add or delete categories on the fly with one NFC tap each. Make a backup card whenever you want a safety net.
4
Recover on a new phone New in 2.0
Get a new iPhone, hand your card to future-you, or replace a lost-and-blocked device — install ChipVault, tap any personalized card, enter the same master password. The card's encrypted Self-Manifesto rebuilds the vault on the new device. Your data was on the chip all along; nothing was ever stored anywhere else, so nothing is lost.

Frequently asked questions

If something isn't covered here, just email — we read everything.

What cards do I need?
Any NXP DESFire EV2 or EV3 card. Common sizes are 2K, 4K, or 8K of EEPROM. They're available from most NFC suppliers online and typically cost a few dollars per card. ChipVault works with all sizes — the storage donut will reflect what your specific card has.
What if I forget my master password?
Your data is not recoverable. ChipVault never transmits or stores your master password, and the encryption keys are derived from it. This is a deliberate trade-off — strong privacy means no recovery backdoor. Write your master password down somewhere safe (a sealed envelope in a fireproof safe is a classic option) before you commit anything important to a card.
What happens if I lose a card?
Whoever finds it cannot read its contents without your master password. The card stores only ciphertext. If you've made a backup card, you still have your data. If you haven't, that data is gone — same as losing a paper notebook. We recommend cloning to a backup card and storing the backup in a separate physical location.
What happens if I get a new phone?
Install ChipVault on the new phone, tap any personalized card to it, and enter the same master password. ChipVault reads the card's Self-Manifesto — an encrypted recovery slot baked into every v2.0-personalized card — and re-establishes the link. Your data was always on the chip itself, so nothing was lost in the device transition. This also works if you simply hand a card to future-you a decade from now: as long as you remember the master password, the card unlocks.
Does ChipVault sync to iCloud?
Your actual stored entries live on the NFC cards themselves, not in iCloud. ChipVault does store a small amount of operational data in your iOS Keychain — specifically the install date (for trial state) and references to which cards you've personalized — and that small set syncs via iCloud Keychain so your trial state and known-cards list survive a device migration. iCloud Keychain is end-to-end encrypted by Apple; we have no access to it.
Is there a subscription?
No. ChipVault is a single one-time purchase that unlocks the app forever on the buyer's Apple ID. A 20-day free trial lets you try everything before buying. We will never add a subscription tier.
Can I change my mind after personalizing a card?
Yes — the Edit Card sheet lets you rename a card, change its color theme, swap its icon, and rename any of its categories without an NFC tap (all metadata-only, instant). You can also add new categories to a card or delete existing ones with one NFC tap each. So your structural choices stay flexible as your needs change.
What if a card's chip memory gets stuck after many delete/add cycles?
DESFire chips occasionally fragment their memory allocator after a sequence of delete-then-add operations — when that happens, the chip can refuse to provision a new category even though it has free bytes in aggregate. ChipVault includes a Reset & Restructure recovery option that reformats the chip and rebuilds it with your current category set (names, icons, colors preserved). It wipes all entries, so you'll want to back up first — but it's a clean way to recover from the rare allocator-stuck case without a full factory reset.
What iPhones are supported?
iPhone 7 or later, running iOS 17 or later. The iPhone's NFC hardware is required to communicate with DESFire cards.
Can I use ChipVault on my iPad?
Not currently. iPads don't have the NFC reader hardware required to read DESFire cards. ChipVault is iPhone-only by necessity.
What about Android?
There's no Android version today. ChipVault is currently an iOS-only product. If you'd find an Android version valuable, let us know — interest weighs into our roadmap.
Is ChipVault open source?
Not at this time. ChipVault is closed-source commercial software. All cryptographic operations use Apple's built-in cryptographic frameworks — no custom-rolled crypto.
Can I read my ChipVault card with a non-ChipVault tool?
Technically yes, but you'll see only ciphertext. Any NFC tool can probe a ChipVault card and see structure, but the contents are AES-128 encrypted and unintelligible without your master password.

Need help? Found a bug? Have a feature request?

ChipVault is built by an indie shop. Every email is read by a human (Nagi). Typical response: same day.