Are vault apps safe? A checklist

Some vault apps protect photos well. Others mostly hide them behind a screen that looks like a lock. From the app store page, they can look identical. The difference shows up in a few specific questions, most of which you can answer yourself in a few minutes.

This checklist is written to apply to any vault app, including ours. Use it before you move anything private in.

Two kinds of "vault"

A hiding place moves files into a folder the gallery does not show and puts a PIN screen in front. The files themselves are ordinary. Anyone who gets past the screen, or who reads the app's storage another way, sees them as they are.

An encrypted vault turns each file into unreadable data using a key. Without the key, the stored data is noise. The PIN or pattern is not just a gate; it is part of how the key is made.

Both can be useful. Only the second protects photos if the lock screen is bypassed. Most of the checklist is about telling them apart.

Start with who you are protecting against

"Safe" depends on the threat. The same app can be more than enough for one person and not enough for another.

If you are worried about	What matters most
Someone glancing at your camera roll	Getting photos out of the main grid. A built-in hidden album may be enough.
Someone who knows your phone passcode	A separate lock with a different code, and auto-lock.
Losing the phone or having it stolen	Real encryption, a slow key function, and a backup you control.
Being pressured to open the app	Whether the app reveals how much it holds. See the duress and deniability guide.
The company itself, or a data breach	No account, on-device encryption, and no way for the company to reset your access.

The checklist

Encryption and keys

Does it say how content is encrypted? Look for a named method such as AES-GCM. "Secure" or "military-grade" on its own says nothing.
Where does the key come from? Ideally it is derived from your code with a deliberately slow function, such as Argon2 or scrypt, so guessing is expensive. A key tied to the phone's secure hardware is a further plus.
Is everything encrypted, or only some of it? Thumbnails, notes and file names matter too.

Accounts and recovery

Does it need an account? An account can mean your files or metadata sit on a server. That can be fine, but you should know where and why.
What happens if you forget the code? If the company can reset it with an email, they may be able to reach your data. If they cannot, you need your own recovery plan, such as a recovery phrase.

Backups and moving phones

How do backups work? Are they encrypted? Who holds them? Can you restore on a new phone, including a different platform?
Does it move or copy? Many apps copy photos in and leave the originals in your library and Recently Deleted.

Behavior on the phone

Does it lock when you leave it? Look for auto-lock and an option to lock immediately.
Does the app switcher preview show your photos?
What permissions does it ask for? Contacts, location or the microphone are odd requests for a photo vault.

The developer

Has it been independently audited? A published security review is a good sign. If one is only planned, treat claims with care until it exists.
Is there a privacy policy, a way to make contact, and a history of updates? An app untouched for years may not keep up with new phone versions.
How does it make money? Heavy advertising in an app holding private photos is worth a second thought.

Five-minute tests

Use a test photo you do not care about.

Import, then look for the original. Check your Photos or Gallery app, and Recently Deleted. If the original is still there, the vault has not protected it yet.
Leave and come back. Switch to another app for a minute, then return. Does it ask for the code?
Check the app switcher. Swipe up or press the recents button. Is your photo visible in the preview?
Try the "forgot code" path without completing it. If an email alone would reset access, the company holds a way in.
Back up and restore. If the app offers backups, make one and restore it, ideally on another device, before you rely on it.

Red flags

Hype words with no detail: "unhackable", "military-grade", "100% secure".
A password reset that needs only an email address.
Many unrelated permissions, or ads that cover the screen.
Promises that hidden content can never be found by anyone.
No updates for a long time, or no way to contact the developer.

When a built-in option is the better choice

A separate app is not always the answer. The iPhone Hidden album, Google Photos Locked Folder and Samsung Secure Folder are free, maintained by the phone maker, and good at keeping photos out of casual view. If the people you are thinking about do not know your phone passcode, they may be all you need.

A separate encrypted vault adds the most when someone else knows or could learn your passcode, when you want a lock independent from the phone's, or when you want control over backups rather than relying on a cloud account.

After you choose

Delete the originals from your library and from Recently Deleted once you have checked the import.
Store any recovery details on paper, away from the phone.
Test one backup and restore while nothing is at stake.
Keep the app and your phone updated.
Review the app's permissions now and then, since updates can add new ones.

How VaultWell answers it

VaultWell is coming soon to iPhone and Android. Measured against the same list:

Content is encrypted on the device in chunks with AES-GCM.
Each vault's path is stretched with Argon2id (64 MiB of memory, two passes), and the key is bound to the phone's hardware: the Secure Enclave on iPhone, StrongBox on Android.
No account. A recovery phrase of six or more words is the only fallback, and we cannot recover it for anyone.
Backups are encrypted .vwbackup files you export and store yourself. There is no cloud sync.
Auto-lock, and an option to lock when the phone is put face down.
An independent security audit is planned, not yet done. Until it is published, weigh our claims accordingly.

The technical detail is on the security architecture page.

Questions

Are free vault apps unsafe?

Price is not the test. A paid app can be a hiding place and a free one can be well built. Run the checklist on any app.

Can a vault app see my photos?

If photos are encrypted on the device with a key only you can unlock, and there is no account or upload, the developer has no copy to look at. If there is an account or cloud storage, ask how it is encrypted.

Is encryption enough on its own?

It is the core, but a weak code, originals left in the library, or a backup stored unencrypted can still undo it.