← All documentation

Why Fixative has two ways to unlock

Fixative asks you to unlock twice: a quick PIN or Face ID / Touch ID to start browsing, and a separate passphrase to open your full-quality originals. This can seem like one lock too many at first. This page explains what each unlock protects and why the split is worth it.

Two locks for two very different moments

Most of what you do in Fixative is light: scrolling your gallery, tidying photos into albums, adding tags, checking what’s in the trash. For that, you want to get in fast, many times a day. A short PIN — or a glance or a fingerprint — is the right fit.

But viewing a full-quality original is a different moment. That’s the sensitive content itself, at full resolution, ready to be opened, edited, or exported. Protecting that with the same quick code you tap dozens of times a day would be weak. So Fixative keeps a second, stronger secret — your passphrase — just for that.

While you’re only browsing, your thumbnails stay blurred. There is no separate stash of sharp thumbnails waiting behind the PIN; seeing a clear image means opening the original, and opening the original is what asks for the passphrase. You don’t enter it up front — Fixative prompts you the first time you reach for an original in a session, and remembers it for a while after that.

Why not just one password?

A single password for everything is simpler to describe, but it forces a bad choice. Make it short and convenient, and everything — including your originals — is only as protected as a code you tap in public all the time. Make it long and strong, and you’re typing a hard passphrase every time you want to glance at your gallery.

Splitting the two lets each lock do one job well. The everyday unlock stays quick because it guards the least sensitive layer. The passphrase can be long and deliberate because you only need it when you actually open originals. Someone who watches you tap your PIN, or who pressures you into unlocking, still can’t reach your originals without the passphrase.

The cost of this design is real and worth stating plainly: because your passphrase guards the originals and Fixative never stores it anywhere it could hand back, no one — not even Fixative — can reset it for you. That is the same property that makes it strong. Your recovery shares exist precisely for this: they are the way back if the passphrase is ever lost. See How your photos are protected.

The two locks time out separately

Each unlock has its own inactivity timer, and they don’t move together. If you unlock your originals, look at a few photos, then go back to just scrolling the gallery, the originals can quietly re-lock on their own while your browsing stays open — because scrolling only counts as browsing activity. The reverse can’t happen: whenever the browsing unlock locks, your originals lock with it. In practice this means you may be asked for your passphrase again after a stretch of browse-only use, even though you never locked anything by hand.

What this means for you

Once the split makes sense, the app’s prompts stop feeling redundant. Being asked for your PIN is the cost of everyday convenience; being asked for your passphrase is the moment your most sensitive content is actually being opened. If a passphrase prompt appears when you didn’t expect it, it’s usually the separate timer above, not a bug.

To act on any of this: