Companion

A passphrase that SQLCipher stretches with PBKDF2 on every connection open. Slower than raw (Room opens up to five connections); prefer raw when the app owns the key.

A 256-bit key used as is, with no key derivation (SQLCipher's raw-key form). The recommended choice: SQLCipher runs no PBKDF2 per connection, and a key from a KDF or a key store is already uniform. The salt is read from the file header.

A 256-bit key plus the database's 16-byte salt, for files whose salt is not stored in the file header.