Short answer: Aegis encrypts its vault with AES-256-GCM, and turns your password into a key with scrypt, not PBKDF2. The scrypt parameters are fixed at N = 32768, r = 8, p = 1. So if you came looking for the maximum PBKDF2 iteration count in Aegis, there isn't one: the setting does not exist, and the cost factor that does exist cannot be raised from the app. What you control is the length of your vault password.
Everything below comes from the vault design document published in the Aegis repository on GitHub (docs/vault.md), read on 14 October 2026. It is the project's own description of its file format and cryptography.
The two building blocks
Aegis uses exactly two cryptographic primitives, and the document names both:
| Role | Primitive | Parameters |
|---|---|---|
| Encrypting the vault | AES-256 in GCM mode (authenticated encryption) | 256-bit key, 96-bit random nonce per encryption |
| Turning a password into a key | scrypt | N = 2^15 (32768), r = 8, p = 1, random 256-bit salt |
GCM is an authenticated mode: besides hiding the contents, it detects any change to them. If someone edits an encrypted vault file, decryption fails instead of producing altered codes.
Why scrypt and not PBKDF2
PBKDF2 slows down password guessing by repeating a hash many times, which is why password managers expose an "iterations" number. Its weakness is that it needs almost no memory, so it runs very well on graphics cards built to make huge numbers of guesses in parallel.
scrypt adds a memory cost. With the standard formula of 128 × N × r bytes, Aegis' parameters work out to 128 × 32768 × 8 = 32 MiB of memory for every single password guess. That is what makes mass guessing expensive on dedicated hardware.
The document is open about the limits of this choice:
- The parameters are fixed. They are the same values Android itself uses to derive a full-disk encryption key, and the document says they cannot be increased without out-of-memory errors on most devices, because of the memory limits Android places on apps.
- Argon2 is on the list, not in the app. The document describes Argon2 as a more flexible modern alternative, since it sets memory and CPU cost separately where scrypt ties them into one parameter, and says it will be considered as a future option.
If you are used to tuning these numbers in a password manager, our guides to master password KDF iterations and Bitwarden's Argon2 settings cover apps where that knob exists. In Aegis it does not.
How the vault is unlocked: key slots
The word on the tiles is the subject of this section: what actually encrypts the vault is one random key, and your password only unlocks a copy of it.
Your password does not encrypt your codes directly. When a vault is created, Aegis generates a random 256-bit master key, and that key encrypts the vault contents.
Each way of unlocking the vault then gets a slot: a copy of the master key, itself encrypted with that credential. The document says the design is largely inspired by the LUKS key slot system used for Linux disk encryption.
| Slot type | What unlocks it |
|---|---|
| Password (0x01) | A key derived from your password with scrypt and a random salt |
| Biometric (0x02) | A key held by the Android KeyStore, usable only after biometric authentication |
| Raw (0x00) | The base format the other two are built on, not used directly in the app |
Two consequences follow from this design:
- The vault is only as strong as its weakest slot. The document says so in these terms: any slot yields the master key, so a weak password is not rescued by a fingerprint slot sitting next to it.
- Changing your password does not need to re-encrypt your codes. With this structure, only the password slot's wrapped copy of the master key has to change.
What the encryption does not cover
- A vault without a password. The document says the vault can be stored in plain text or encrypted with a password. Encryption only applies if you set one.
- The file structure. Integrity checking covers the encrypted contents and the wrapped keys in the slots. The document states that the rest of the file is not checked.
- Nonce limits. AES-GCM with a random 96-bit nonce must not be used for more than about 2^32 encryptions under one key. The document acknowledges this and argues that no user will save a vault anywhere near that many times. It mentions switching to a nonce-misuse-resistant cipher as a future possibility.
What this means for your backups
The vault format is public, and the Aegis repository even ships an example script (docs/decrypt.py) that decrypts a vault file given the password. That is useful: an encrypted vault file is not locked to the app. It also means that whoever obtains a copy of that file faces only your vault password, at 32 MiB of scrypt per guess.
So the practical advice is short:
- Set a vault password if you have not. Without it, nothing is encrypted.
- Make it a long passphrase you do not use anywhere else, ideally generated. Length is the cost you can raise; the scrypt factor is not.
- Keep biometric unlock if you like the convenience, but do not treat it as a reason to choose a weaker password.
- Store backups somewhere you control, and test a restore once.
★ Cure53 audit · ✓ Free plan · Cross-platform
A strong vault password is only useful if you can remember itA password manager generates and stores a long, unique passphrase, so the one guarding your 2FA backup is not a reused one.→Where to go next
If you are still choosing an app, our Aegis vs Google Authenticator comparison puts this local encrypted vault next to a cloud-synced alternative, and our best authenticator apps guide covers the cross-platform options. Changing phone soon? Read moving an authenticator app to a new phone before you wipe the old one.
The bottom line
Aegis protects your 2FA secrets with AES-256-GCM and a random master key, unlocked by scrypt-derived password keys or Android KeyStore biometrics. There is no PBKDF2 and no iteration slider: the key derivation cost is fixed at N = 32768, r = 8, p = 1, about 32 MiB per guess, by design and because of Android's memory limits. The strength you add is the length of your password.
★ Cure53 audit · ✓ Free plan · Cross-platform
A manager with built-in 2FA & passkeys → NordPassStore TOTP & passkeys · XChaCha20 · free tier→Frequently asked questions
How many PBKDF2 iterations does Aegis use?
None. Aegis does not use PBKDF2 to derive the key from your vault password. Its design document names scrypt as the key derivation function, with fixed parameters N = 2^15 (32768), r = 8 and p = 1. There is no iteration count to raise in the app.
Can I make the Aegis password stronger by raising the scrypt cost?
Not from the app. The Aegis documentation says these are the same parameters Android uses for full-disk encryption key derivation, and that raising them is not possible without running into out-of-memory errors on most devices. The lever you control is the password itself: a long random passphrase adds far more work for an attacker than a higher cost factor would.
What cipher encrypts the Aegis vault?
AES-256 in GCM mode. A random 256-bit master key encrypts the vault contents, and each way of unlocking the vault (password or biometrics) stores its own encrypted copy of that master key in a slot.
Is the Aegis vault encrypted by default?
Aegis lets you choose. Its documentation says the vault can be stored in plain text or encrypted with a password. If you skipped the password at setup, your secrets are stored unencrypted on the phone, so set one in the app's security settings.
Does unlocking with a fingerprint weaken the encryption?
Biometric unlock adds a second slot whose key is held by the Android KeyStore. The documentation states that the master key is only as secure as the weakest credential. The password slot still matters, because it is the one that protects an exported or backed-up vault file outside the phone.
