How to hide photos on Android
Five methods, in order of how much they actually protect. Most people should stop at the third one. The last section matters more than the choice.
Locked Folder against a vault app
AlterVault
Locked FolderStops
Showing up in your gallery
✓
✓
A file manager
✓
✓
Other apps with media access
✓
✓
Safe from a computer with a cable
✓
✕
Someone who knows your PIN
✓
✕
Someone asking you to open it
Decoy
✕
How it works
Files encrypted
XChaCha20-Poly1305
✕
Unlocks with
A code you chose
Screen lock
No account needed
✓
Google
Holds documents and PDFs
✓
✕
Practicalities
Moves to a new phone
Backup file
Optional backup
Cost
$19.99 once
Free
The methods that are not protection
A dot in the folder name, or .nomedia
A request that the gallery app ignore a folder. Any file manager shows it with one toggle. No code, no lock, no encryption.
Your gallery app's hide feature
Samsung, Xiaomi and most manufacturer galleries have one. There is at least an authentication step, but it is usually your screen lock, and it rarely survives a change of phone brand.
Locked Folder, the right default
Open Google Photos, tap Collections, then Locked, then Set up Locked Folder.
- What it gives you
- Items stay on the device, are not uploaded to Google Photos, are hidden from other apps even with media permission.
- Where it stops
- It opens with the same screen lock as your phone, so anyone who knows your PIN is already past it. There is no decoy, it holds photos and video only, and the contents do not transfer to a new phone by default.
When you need a vault app instead
Worth it when the person you are protecting against can ask.
- A secret that is not your screen lock
- AlterVault derives its key from a code you choose with Argon2id, then encrypts every file with XChaCha20-Poly1305 before it is written.
- Something to hand over
- Shake once and the vault becomes an ordinary gallery. Shake again for a code pad nobody else can fill.
- Documents too
- PDFs and scans arrive through the system picker into the same encrypted store.
The cleanup that decides whether any of it worked
Hiding one copy does nothing if three others sit somewhere you forgot.
- Check the cloud first
- If Google Photos backup was on when the photo was taken, it is on Google's servers. Delete it at photos.google.com too.
- Empty the trash
- Deleted photos stay fully viewable in the bin for up to 60 days.
- Audit media permissions
- Settings, Security and privacy, Privacy, Permission manager, Photos and videos.
- Strip location data
- Photos carry GPS coordinates and exact times in EXIF.
- Check the other apps
- WhatsApp, Telegram, Signal and Instagram all keep their own copies.