Short answer
Against someone who picks up your phone, most vault apps are fine. Against anyone who reaches the files underneath, it depends on the design, and many fail: a 2022 study of 20 popular Android vault apps found only 5 attempted to encrypt files, and most files could be recovered with basic tools. The safe design encrypts each file on the phone with a key derived from a code only you hold, so nobody else, including the company, can open it. The quickest test is the password reset. If an email can get you back in, your code is not the key.
On this page
- Real encryption vs a folder hider
- Three kinds of app, all called a vault
- Twelve years of research, in order
- What has changed, and what has not
- Who each design actually stops
- Are calculator vault apps safe?
- Six tests you can run in ten minutes
- What no vault can do for you
- How AlterVault scores on its own six
- What to actually do
- Questions
Real encryption vs a folder hider
The folder hider column is the design researchers keep finding, not one named app. AlterVault facts come from the app source.
AlterVaultA folder hider can still stop a nosy friend. It simply stops nobody else.
Three kinds of app, all called a vault
- Folder hider
- Photos move to a directory the gallery does not scan. Files stay as ordinary images with their metadata intact. The PIN protects the interface, not the data. In a 2022 study, 9 of 20 popular Android apps relied on hidden folders.
- Encrypted, key held elsewhere
- Files are scrambled, but the key sits in the phone's keychain or on the company's server, not in your head. This stops a casual look and a stolen phone. It does less against forensic tools, the company, or a court order.
- Encrypted, key from your code
- The key is derived from a code you hold and stored nowhere readable. Each file is unreadable without that code, including to the people who wrote the app. The price is real: no email reset, and you own the backup.
Twelve years of research, in order
Each study tested particular versions of particular apps. Read them as evidence about designs, not as verdicts on what an app does today.
- 2014: Zdziarski on Private Photo Vault
- Forensics researcher Jonathan Zdziarski recovered the app's data from a locked iPhone in about five minutes using a pairing record from a computer. The app added no protection beyond what iOS gives any other file, while calling photos "100% private".
- 2015: IOActive on three iOS vaults
- Private Photo Vault and My Media stored photos unencrypted with credentials in plaintext. The Private Photo Vault and KeepSafe lock screens could be bypassed on a jailbroken iPhone, and KeepSafe's server returned album passwords in plaintext.
- 2017: Zhang, Baggili and Breitinger on 18 Android apps
- About 220 million combined downloads. 6 of 18 did not encrypt photos, 8 did not encrypt videos, 7 stored passwords in cleartext, and hidden data could be found without root on 10. The work helped Connecticut law enforcement rebuild 66 images and 18 videos in one criminal case.
- 2019 to 2021: forensicmike1 on Private Photo Vault
- Real progress: by 2019 the app used AES. The master key sat in the iOS Keychain, did not change when the PIN changed, and the PIN itself was stored there in plaintext. A 2021 update found per-item keys and an encrypted database, with brute-forcing the PIN still possible but slower.
- 2021: US Department of Defense Cyber Crime Center
- Its advisory said newer vault apps have stronger security but can still be exploited forensically. One Android calculator vault simply hashed the password with MD5 and added 10 bytes to the front of each file. NQ Vault encrypted only the first 128 bytes.
- 2022: Ruffin and colleagues on 20 Android apps
- Peer-reviewed at the ACM Workshop on Privacy in the Electronic Society. Only 5 of 20 attempted to encrypt files. 10 allowed a full backup without root and 5 more left files on shared storage. The authors' adversary needed only rudimentary knowledge of Android.
- 2025: Photo Vault by Brain Craft
- Cybernews reported a passwordless Firebase database exposing file and folder names tied to email addresses, plaintext passwords and notes, for an iOS app with about 72,000 downloads. No phone had to be touched. This is a different app from Private Photo Vault.
Sources: Jonathan Zdziarski: Private Photo Vault, Not So Private (2014), IOActive: Breaking into and Reverse Engineering iOS Photo Vaults (2015), Zhang, Baggili and Breitinger: Breaking into the vault, Computers & Security (2017), forensicmike1: iOS photo vault app still pwnable in 2019, updated 2021, US Department of Defense Cyber Crime Center: Photo Vault technical advisory, Ruffin et al.: Casing the Vault, ACM WPES (2022), The Dead Pixels Society on the Cybernews Photo Vault report (2025)
What has changed, and what has not
- The big names now name a cipher
- Keepsafe says files are protected with 256-bit AES at rest. Private Photo Vault says files in the app use AES and that its optional Cloud Vault adds AES-256 with Argon2id. The versions of Private Photo Vault tested in 2014 and 2015 had nothing of the kind.
- The question moved to the key
- Encrypted is no longer the interesting word. Who can produce the key is. Keepsafe's help centre says it "is not currently designed as a completely zero-knowledge app". Private Photo Vault can recover a forgotten app password through a recovery email.
- Nobody publishes a test of today's build
- The last public teardown of Private Photo Vault we know of is from 2021. Its own security page says it is "product documentation, not an independent security audit". That sentence applies to AlterVault too.
- The long tail is the worry
- The 2022 study is the most recent broad sample we know of, and 15 of its 20 apps did not attempt encryption. A well-known name is not a guarantee, but an unknown free app from a store search deserves real suspicion.
Sources: Keepsafe Help: How does Keepsafe protect my data?, Keepsafe Help: Can Keepsafe see any of my content?, Private Photo Vault: How your private photos are protected, Private Photo Vault: FAQ, Ruffin et al.: Casing the Vault, ACM WPES (2022), Vaultaire, a competing app: Photo vault security audit of store listings (June 2026)
Who each design actually stops
- Someone who picks up your unlocked phone
- All three designs stop them, as long as the app has its own code. This is the threat most people have, and it is why a folder hider can feel fine for years.
- Someone who knows your phone PIN
- Any vault with a separate code stops them. The iPhone Hidden album and Google Photos Locked Folder do not, because both open with the phone's own passcode or screen lock.
- Someone with a computer and a cable
- A folder hider fails. In the 2022 study, files from 15 of 20 apps were pulled off with standard developer tools and no root. Encrypted apps give up sealed files at most.
- Forensic tools with a full extraction
- A key stored on the phone can be extracted along with the files, which is what happened to Private Photo Vault in 2019. A key that exists only when your code is entered leaves them guessing the code, so its length starts to matter.
- The company, a breach or a court order
- A vault with a server has something to hand over or lose. An app with no server and no key has neither. This is the case the Brain Craft leak made.
- Someone who makes you open it
- No cipher helps here. This is what a decoy is for: something plausible to show instead.
Are calculator vault apps safe?
A calculator vault is a disguise, and a disguise is a separate question from encryption. The icon hides that the app exists. It does nothing to the files behind it, and the worst examples in the research are in this group. The Defense Department advisory describes one that only hashed the password and prepended 10 bytes to each file, which is hiding, not encrypting.
The disguises are often thin as well. In the 2022 study 10 of 20 apps offered a decoy icon such as a calculator or clock, only 5 turned it on automatically, and the authors found most did not disguise themselves properly everywhere on the phone. The real name can show up in the settings app list or in search. A calculator vault can be fine if it also encrypts properly. Run the tests below on it, and do not treat the calculator as the protection.
Sources: US Department of Defense Cyber Crime Center: Photo Vault technical advisory, Ruffin et al.: Casing the Vault, ACM WPES (2022)
Six tests you can run in ten minutes
No jailbreak and no technical knowledge. These work on any vault app, including this one.
- Try the password reset
Tap Forgot PIN and read what it offers. If an email or a support agent can get you back in, your code is not the key, and the key sits somewhere the app can reach without you. A recovery phrase you wrote down is different: it is a second secret that only you hold.
- Check its permissions
A vault with full photo library access can read every photo on the phone, not just the ones you gave it, and it keeps that access. The system picker exists so an app needs no standing access at all.
- Use it in airplane mode
Add a photo, open it, scroll. Then watch the app's data usage for a week. Small amounts are normal for a purchase check or usage events. Hundreds of megabytes from a local vault is not.
- Uninstall and reinstall
With a test photo, not your library. If photos come back after you sign in, without you restoring a backup file, they were on a server.
- Read the store labels
Check the App Store privacy label or Google Play Data safety section. They are self-reported, so they prove little alone. But a label that links photos to your identity, or declares tracking, is on the record against a listing that says everything stays private.
- Look from outside the app
On Android, open a file manager with hidden files turned on and look for folders the app created, or connect the phone to a computer. If you can open a photo from there, the PIN was protecting nothing. In the 2022 study, 9 of 20 apps relied on hidden folders.
What no vault can do for you
- Copies outside the vault
- The originals in your gallery, Recently Deleted, Google Photos, iCloud and chat apps are not touched by locking a copy. Private Photo Vault's own security page makes the same point.
- A weak code
- A key derived from four digits is only as strong as four digits once the files leave the phone. Use the longest code you will remember.
- A compromised phone
- Spyware that can see your screen sees what you see when the vault is open. Encryption protects files at rest, not files on the display.
- Apps with photo access
- SparkCat, found in both app stores in 2025, used on-device text recognition to scan galleries for crypto recovery phrases. Anything you screenshot and leave in the gallery is exposed to every app you gave photo access. That includes recovery phrases, passports and banking details.
- Your own backups
- Encrypted files in an iCloud or Android backup stay encrypted. Exported or unhidden copies do not. Turn off cloud photo sync before you move anything out of a vault.
Sources: Private Photo Vault: How your private photos are protected, Kaspersky Securelist: SparkCat in the App Store and Google Play (2025)
How AlterVault scores on its own six
Welcome back!
Enter your PIN
- Password reset
- There is none. The key comes from your code through Argon2id. A forgotten code is answered by the 12-word recovery phrase you saved, which nobody can send you, on the phone it was made on.
- Permissions
- On Android, the photo, video, camera, microphone and biometric permissions are removed from the build, and files arrive through the system picker. On iPhone, the only photo permission it ever asks for is when you choose to delete originals after an import.
- Airplane mode
- The vault works with no network at all. Online, the app contacts RevenueCat for the purchase and sends anonymous usage events to PostHog. Neither carries photos, file names or your code. The privacy policy lists every event.
- Uninstall
- The photos go with the app. There is no server copy, which is why the encrypted backup file exists and why you have to make it yourself.
- Store labels
- There is no account and no file data to declare, because nothing about your files is collected. The privacy policy lists every event and purchase detail, so you can compare it with the store label yourself.
- From outside the app
- Every file is sealed with XChaCha20-Poly1305 in 32 KiB chunks, thumbnails included, and the index holding names and dates is sealed too. A file manager or a cable shows blobs.
- The one it fails
- The source is not published and we have no outside audit to show you, so the cipher is our word rather than something you can read. The other checks all run against the installed app.
What to actually do
Run the first and last tests on whatever you use today. If your app has an email reset and a folder you can open from outside, it is a curtain, and that may be all you need for photos you would rather not scroll past in front of someone. It is not enough for anything with a consequence.
For anything with a consequence, use a design where the key comes from your code, set a long code, and clear the copies left outside the vault. AlterVault is built that way, and the free tier covers enough items to run all six tests on it before you pay.
Questions
Are photo vault apps safe to use?
It depends on the design. An app that encrypts each file with a key derived from your code is safe against a stolen phone, forensic tools and the company. An app that hides files behind a PIN is safe only from casual snooping. Try the password reset: if an email gets you back in, your code is not the key.
Are calculator vault apps safe?
The calculator is a disguise, not protection. Some of the weakest apps in published research are calculator vaults: a US Defense Department advisory describes one that only hashed the password and prepended 10 bytes to each file. Their disguises can also slip, with the real name visible in settings. Judge one by its encryption.
Can photo vault apps be hacked?
Yes. Cybernews reported an iOS app called Photo Vault leaking file names, emails and plaintext passwords through an open database, with no phone involved. Apps that hide files without encrypting them can simply be read. An app with no server has no equivalent database to leak.
Do photo vault apps actually encrypt photos?
Many do not. A 2022 study found only 5 of 20 popular Android vault apps attempted to encrypt files, and a 2017 study found 6 of 18 left photos unencrypted. Larger names such as Keepsafe and Private Photo Vault now say they use AES. Military-grade is not a claim. A named cipher and key derivation function is.
Can police or forensic tools open a vault app?
Often, yes. Vault apps were studied partly because investigators need to open them, and one study helped police recover images in a criminal case. Tools can extract files, and any key stored on the phone with them. A key derived only from your code is much harder, though a short code can still be guessed.
Is the built-in Hidden album or Locked Folder safer than a vault app?
Safer than a bad vault app, weaker than a good one. Both are built by the platform and do not leak. Both also open with your phone's own passcode or screen lock, so anyone who knows that is already through, and neither offers a decoy.
What does it mean if a vault app can reset my password?
Your files are not encrypted with a key derived from that password. If they were, losing it would lose the photos. A working reset means the key is somewhere the app can reach without you, on the phone or on a server. It does not prove the company reads your photos, only that your code is not the lock.
Can someone tell I have a vault app?
Usually, if they look. Icons can be disguised, but researchers found most disguises were incomplete, with real names visible in settings or search. Store purchase history shows it too. That is why a decoy is worth more than a disguise: it gives you something to show when asked.
Are free photo vault apps safe?
Free is not the problem; the business model is. Many free vaults are funded by ads, and Vaultaire's June 2026 review of store listings, by a competitor, found 7 of 12 declaring tracking. Check the store label, then run the six tests. Open-source options such as Photok let you see what the code does.