Open-source iOS app to securely unseal OpenBao and HashiCorp Vault with Face ID.
Sealbreak is a small iOS app for securely storing a Shamir unseal share for OpenBao or HashiCorp Vault on your iPhone and submitting it only after explicit Face ID authorization.
Configure your OpenBao server and import an unseal share once. When OpenBao needs to be unsealed, open Sealbreak and tap Unseal.
Sealbreak confirms that it is communicating with the configured server before requesting Face ID. Only after successful authorization is the device-bound share released and submitted. The app then checks OpenBao again to confirm the resulting state.
Sealbreak treats the unseal share as sensitive key material rather than a regular app credential. It remains bound to the device and protected by Face ID, without cloud synchronization or an export path.
Security assumptions, design decisions, and known risks are documented openly in the project's threat model. It provides the basis for reviewing the security of Sealbreak as the project evolves.
Sealbreak is licensed under the GNU General Public License v3.0.