AlterVaultvsPrivate Photo Vault

Private Photo Vault alternatives

One of the most installed vault apps on iOS, and one of the most thoroughly taken apart. Here is what researchers found, and what to move to.

The AlterVault photo grid running on a phone

AlterVault vs Private Photo Vault

AlterVault
Private Photo Vault
Encryption
Cipher on your files
XChaCha20-Poly1305
None
Key derived from
Your code (Argon2id)
n/a
Unreadable if extracted
Hiding
Decoy
Shake gesture
Decoy password
Visible to the other person
Nothing to see
You type a code
Multiple vaults
Pro
Money and trust
Price
$19.99 once
~$19.99 / yr
No account needed
Optional cloud
No password reset

Storage as reported in Jonathan Zdziarski's teardown. The Firebase leak was a different app, Photo Vault by Brain Craft.

Why switch

What the research found

Jonathan Zdziarski, an iOS forensics researcher, published a teardown titled Private Photo Vault: Not So Private. Photos were stored as ordinary files rather than encrypted ones, with the PIN gating the interface. IOActive reported the same pattern across several iOS vaults.

The widely reported Firebase leak was a different app, Photo Vault by Brain Craft, not Private Photo Vault.

Why an unencrypted vault still feels safe

Nothing about using one feels different. Every visible signal says it worked.

The difference shows when something reaches past the interface. An encrypted vault yields unreadable blobs. An unencrypted one yields your photos.

What AlterVault changes

The storage layer that was missing
Every file sealed with XChaCha20-Poly1305 in 32 KiB chunks, thumbnails included, with the chunk index bound into the authentication so chunks cannot be reordered.
A shake instead of a second password
Typing a decoy password in front of someone is an act they can watch and repeat. A shake fires from a phone you are already holding.
$19.99 once
Instead of about $20 a year. Free up to 10 items so you can test the migration before paying.

Welcome back!

Enter your PIN

123456789

Migrating without losing photos

Lost photos during export is this category's most common complaint.

  1. 01
    Export in batches
    Back to the camera roll, not all at once. Count what arrives.
  2. 02
    Check the resolution
    Open several. Silent compression on import is where quality loss hides.
  3. 03
    Import and verify
    Count again before deleting anything from the old app.
  4. 04
    Strip location data
    Photos that sat in a vault still carry EXIF GPS. Remove it during the move.

Questions

A PIN pad is not encryption

No account. Nothing leaves your phone.