Vault Pure 1.0.8: a new look, and a bug R8 introduced

8 to 10 October 2026:

Six builds in three days: versionCode 18 to 23, the name stayed 1.0.8. As of today version 23 is in production on Google Play. First the bug that stayed hidden the longest, then everything you can see.

The bug: R8 renamed the key parameters

Next to the password key, every vault stores a few parameters as JSON: salt, initialisation vector, algorithm, round count. Gson writes the field names of the class for that. In the release build R8 shrinks the code, calls the fields a and b and throws out those whose value it can prove constant.

The result: every vault created by a Play build up to versionCode 18 carries only {"a": salt, "b": IV}. The algorithm and the round count were nowhere in the vault, only in the code.

It showed up as soon as a change made one of those values variable. The field was back, the stored JSON held nothing for it, and unlocking failed with a NullPointerException. Worse, the higher round count for new vaults would have hit old ones too, which would then have been opened with the wrong key.

The fix has three parts:

• A dedicated adapter writes the parameters with fixed, real names. How R8 obfuscates the code no longer matters for the stored format.
• When reading, it also understands the old a/b form and fills in what the old builds had baked in: 210,000 rounds.
• Keep rules hold R8 off these classes. That covers backups too, which carry the same parameters.

Tests read in exactly the old format. A vault from an earlier version opens again after the update.

A stronger password scheme

New vaults derive the key with 600,000 instead of 210,000 PBKDF2 rounds. On older phones, unlocking with a password can therefore take a few seconds, and the app now says so beforehand. The lockout after failed attempts is stricter as well.

The look

• Version 18: Navy and gold, taken from the app icon. A lock in the background with photos, documents and seals drifting inside. The app is dark only, the theme setting is gone.
• Versions 19 and 20: The overview gets sections, then small tiles and a bottom bar. Settings are split: everyday things up front, protection and lock under “App settings”.
• Version 21: Golden header bars with the app icon, an orange branch as a calm background and an eye button that hides thumbnails.
• Version 22: A tree grows on the login screen instead of the old vault animation. The settings cog sits in every bar, “Protection” became “Manage”, the decoy vault is laid out in cards.
• Version 23: The tree is redrawn, with a crown of many small leaves and golden fruit.

For exactly one build the app was called “Tresor Pur”, by the way. It is Vault Pure everywhere again.

How the store images are meant to be made

The store images should come from the real app. A test walks through the screens on a virtual device at Firebase Test Lab and takes the pictures. One hurdle: the app sets FLAG_SECURE, so ordinary captures come out black. The test first switches on the app's own “Allow screenshots” setting.

Measured

• Builds: 6 in 3 days
• Round count of new vaults: 210,000 before, 600,000 now
• Release notes: written in 24 languages

A vault that will not open after an update is not a vault.