A RizKharj backup is an ordinary JSON file: every transaction, account and setting is written in it as plain text. That is fine while the file stays on your phone, but backups usually travel to iCloud Drive, Google Drive, e-mail or WhatsApp. The backup file password exists for that moment: without the password the file is just a few lines of meaningless characters.
The app lock is not the backup password
The 4-digit PIN (or Face ID) only locks the app screen and does nothing to files. The backup password encrypts the file contents. You can use either one on its own.
Switching it on
In the app go to Settings › Data & backup › Backup file password and type a password of at least 6 characters twice. From that moment:
| Locked | Not locked |
|---|---|
| The backup file you create with "Back up" | The data inside the phone itself (protected by the iOS or Android device lock) |
| The automatic copy in iCloud Drive or Google Drive | CSV exports for Excel and PDF reports |
The password stays on this device only and is never written into any file.
Restoring on a new phone
When you "Restore from backup" or connect iCloud/Drive, the app sees that the file is locked and asks for the password. With the right password the file opens and the password is saved on the new phone too, so the automatic backups continue the same way.
Rules worth knowing
| Situation | What happens |
|---|---|
| A file was created with a password | That file always keeps that password. There is no way to strip the password from an existing file. |
| You remove the password in the app | Only future backups are created without a password. The iCloud/Drive copy is replaced right away by a copy without a password; older files you saved somewhere yourself still need the old password. |
| You change the password | The iCloud/Drive copy is rewritten with the new password; earlier files open with the earlier password. |
| You forget the password | Locked files cannot be opened; RizKharj has no server and no "password recovery". Keep the password in a password manager. |
| Changing or removing the password | The current password is always required, so someone holding your unlocked phone cannot quietly take it off. |
Technically
Encryption uses AES-256-GCM; the key is derived from your password with PBKDF2-SHA256 and 150,000 rounds, with a fresh random salt and IV for every file. Everything happens with the built-in cryptography of the browser and operating system on the device; nothing is sent anywhere. A locked file is still a small JSON that only contains the cipher name, salt, IV and the encrypted data, so it works with every cloud service and every e-mail.