Quick Start

What is Arcanum?

Arcanum is an encrypted vault manager for Android that creates and opens standard VeraCrypt containers. Your files are stored inside encrypted containers using the same audited cryptographic code that powers VeraCrypt on Windows, macOS, and Linux. Any vault you create in Arcanum can be opened directly in desktop VeraCrypt, and vice versa — there is no proprietary format.

Opening the app

Arcanum presents itself as a plain calculator on your home screen and in the app drawer. To open the vault interface, type your PIN (4–12 digits) on the calculator then long-press the = key for 2 seconds. The app will unlock and navigate to your vault list.

If you haven’t set a PIN yet, the first launch will take you directly to setup.

Creating your first vault

Tap the + button on the vault list screen to start the creation wizard. The wizard walks you through 10 steps for a standard vault:

1. Volume type — choose Standard Volume (or Hidden Volume if you need plausible deniability; see Hidden Volumes).
2. Location — store the vault inside Arcanum’s private storage (no extra permissions needed), or pick a folder anywhere on your device (requires “All Files Access” on Android 11+). Enter a filename — the default is vault.hc, but any extension works.
3. Encryption algorithm — AES is the default and the fastest on modern hardware. All options are VeraCrypt-compatible. You also select a hash algorithm here (SHA-512 is the default), or Argon2id, which derives the key from memory rather than repetition.
4. Volume size — choose a preset (256 MB → 10 GB) or enter a custom size in MB or GB. The smallest vault Arcanum will create is 5 MB; a smaller one made by VeraCrypt on a computer still opens here.
5. Password — type and confirm your password. A live strength meter shows Weak / Fair / Strong / Very Strong as you type. Optionally attach a keyfile — either an existing file or a fresh one via Generate new keyfile, see Keyfiles — or enter a custom PIM for extra security. There is no password recovery — if you lose your password, your data is unrecoverable. Note: if you set a PIM below 485, your password must be at least 20 characters long — the wizard enforces this.
6. Format mode — Quick Format is faster; Secure Format overwrites the entire container with random data first (slower but leaves no trace of previous content).
7. Filesystem — FAT is recommended for most users and works on all operating systems. Choose exFAT if you need to store individual files larger than 4 GB, or ext4 if you only ever open the vault on Linux or on your phone. See Choosing a Filesystem.
8. Entropy — drag your finger around the canvas to collect randomness for key generation. 500 unique touch points are required.
9. Creating — Arcanum formats the container. A progress indicator shows speed and time remaining.
10. Done — your vault is created. Tap “Open vault” to mount it immediately.

Choosing a PIM

PIM (Personal Iterations Multiplier) controls how many PBKDF2 iterations Arcanum uses to turn your password into the key. More iterations make guessing a password slower for an attacker, at the cost of a slightly longer unlock:

• Leave it empty and Arcanum uses VeraCrypt’s default of 500,000 iterations — secure, and the right choice for most people.
• Set a value and the count becomes 15,000 + (PIM × 1000). So a PIM of 485 matches the default, a PIM of 700 gives 715,000 iterations, and so on.

A higher PIM only adds a little unlock time — it never weakens anything, so there is no “too high” from a security standpoint. Because a PIM below 485 drops the count below the default, the wizard requires a password of at least 20 characters in that case.

With Argon2id the PIM means something different: it sets how much memory each attempt costs, from 64 MB upwards, and the floor for a short password is 12 rather than 485. That page has the table.

The single biggest factor in a vault’s strength is a strong, high-entropy password — that matters far more than the PIM. A high PIM cannot rescue a weak password. See What is a PIM? for a short recap.

Basic navigation

Once a vault is mounted, Arcanum gives you a full file manager and media viewer inside the encrypted container. Files are decrypted on the fly — they never exist unencrypted on your device’s storage.

Tap the lock icon or navigate back to the vault list to unmount. If Auto-Lock is enabled in Settings, Arcanum will automatically lock when the app goes to the background.

The vault list

Tapping a vault opens it: if it is already open you go straight in, and if it is not you are asked for the password. Everything else is behind a long press — unmount, rename, select, and Vault Info, the vault’s own page with its details, its settings and the things you do rarely: change the password or keyfiles, back up or restore the header, move it, forget it, delete it.

The list is grouped by where each vault is kept. Under a vault’s name is when it was last opened; the heading above it already says where it lives.

Photos and videos

The Gallery tab shows every photo and video in the vault as one grid, with sorting, search, and a folder button that limits it to the folders you choose. See Photos and Videos.

Renaming a vault

A vault’s name in Arcanum is a label, and for most vaults it is only that.

If you added the vault by picking its file, renaming changes the name in Arcanum and leaves the file alone. This is not a shortcut: Android gives an app access to a picked file by that file’s name, so renaming the file would take the access away with it and the vault would stop opening. If you want the file itself renamed, rename it in a file manager and add the vault again.

If a vault’s file is moved or lost, its card shows a crossed-out folder and tapping it offers to find the file again - see Backing Up Your Settings, which covers the same ground for a new phone.

A vault that Arcanum keeps in its own storage is renamed properly, file and all. A vault on a USB drive is renamed in the list without the drive being connected, since its name is not stored on the drive at all.