Forgot Your Photo Vault Password?

1. Two kinds of vault app

Vault apps split on one question: can the developer restore your access without your password? Some can. Their apps have accounts, reset emails or recovery processes. If yours is one of them, a forgotten password is a nuisance, not a loss. Some cannot, because the files are encrypted with a key made from the password itself, and no copy of that key exists anywhere else.

Neither design is wrong. They are different trades, made before you ever forgot anything. The rest of this page is about telling which one you have and what follows from each.

2. Which kind you have, and how to tell

Three places to look, in order:

1. The app's own lock screen. A "forgot password" or "forgot PIN" option is the clearest possible sign that a reset exists. Tap it and follow it before trying anything else.
2. The developer's support pages. Search them for "forgot", "reset" or "recover". A developer with a reset process writes it down, because it is one of their most common support requests.
3. Whether the app has an account. If you signed up with an email address, there is a server that knows who you are, and recovery is at least possible. An app with no account has nobody to send a reset to.

One thing worth understanding while you look: if a reset exists, the developer holds something that can unlock your files without your password. That is what makes the reset work. It is a reasonable trade. Forgetting a password is far more common than being targeted by anyone. But it is a different kind of security than the word vault usually suggests, and it is worth knowing which one you accepted. Our comparison of what vault apps publish treats this as the single most telling question you can ask about any of them.

3. Why encrypted vaults have no reset

A password reset works when somebody holds a copy of the thing being protected, or a key to it. Your email provider can reset your password because your mail sits on their servers in a form they can read. That is a reasonable design for email. It is the opposite of what an encrypted vault is for.

In Obscura Photo Vault, the chain from password to photo runs like this:

1. Your password goes through 600,000 rounds of a slow process called PBKDF2, together with random data stored with the vault. That produces a key.
2. That key unlocks a second key, the one the vault's data is actually encrypted with. The second key is stored only in this locked form.
3. The unlocked second key opens the database and the photo files. It exists only in memory while the vault is open.

Nothing in that chain is stored in a form that can be reversed without the password. The locked key on the phone is useless on its own. There is no copy of the unlocked key, on the phone or anywhere else, because the app never writes one. When the vault locks, the key in memory is wiped.

So when we say we cannot recover your vault, we are not refusing. We do not have anything to recover it with. The security paper documents this in full, including where it is weaker than you might assume.

4. What Face ID is, and is not

Face ID and Touch ID are a shortcut on top of the password, not a replacement for it. When you turn on Face ID unlock, the app stores your vault password in the iOS Keychain, protected so that only your face or fingerprint can fetch it. Unlocking with your face fetches that stored password and uses it exactly as if you had typed it.

Two things follow, and both surprise people:

• Face ID cannot stand in for a password you have forgotten. There is no separate key made from your face. That is not how any of this works.
• iOS will sometimes take the shortcut away. The stored password is tied to the faces and fingerprints the phone knows right now. If a new face or fingerprint is added, iOS wipes it. That is a deliberate protection against someone adding their own face to your phone. The app then asks for the password. If you never knew it, that is the moment you find out.

Treat Face ID unlock as a way to avoid typing, and keep the password saved somewhere else.

5. What you get in exchange

No-recovery is a trade, not a pure benefit. A page that only lists upsides is not worth reading.

What you give up: the safety net. Every other account you own has one. This does not. A forgotten password here is permanent, and that risk is real, not theoretical.

What you get: the same rule runs the other way. Because no recovery path exists for you, none exists for anyone else either. There is no support process to trick, no reset email to intercept, no account to take over, and nothing we can be made to hand over, because we do not hold it. No back door and no reset are the same fact. You cannot have one without the other.

6. What to do before you need it

Two habits. They protect against different failures, so do both.

Save the password properly

A password manager is the right tool. It survives a lost phone, it is backed up, and it does not depend on your memory. Written on paper and kept somewhere safe is also a fair answer, especially for a password you will type rarely and need for years.

What does not work is planning to remember it. A vault password gets typed less often than any other password you own, especially once Face ID unlock is on. Rarely used passwords are exactly the ones that go.

Export an encrypted backup

Obscura Photo Vault can export a vault to a single .obscura file. That file is protected with the same AES-256-GCM encryption and the same 600,000 rounds as the vault itself. So it is safe to keep anywhere, including cloud storage, because without the password it cannot be read.

Export, then check the export by importing it. An untested backup is a guess. Keep it somewhere that is not the phone: a computer, an external drive, a cloud account. This protects against a lost, stolen or broken phone, which is far more common than a forgotten password.

7. If you have already forgotten it

For an app with a reset, use the reset. That is what it is for. The rest of this section is for encrypted vaults without one, including ours. We would rather give you a straight answer than a hopeful one. There is no trick, tool or support request that opens an encrypted vault without its password. Guessing is not practical either. The 600,000 rounds are built to make every guess expensive, and the app adds a growing delay after repeated wrong attempts.

Two things are still worth knowing.

Do not delete the app

Half-remembering is worth pursuing

Attempts are slowed by a delay, not stopped by a lockout that destroys data. So trying variations you genuinely half remember is reasonable. Check your password manager, including entries you may have saved and forgotten. Check any note you might have made at the time. Check any device where the vault might still be unlocked, or where Face ID unlock still works. An unlocked vault on a second device lets you export the contents.

If none of that works, the answer is that the data is not recoverable. We are sorry. It is the same property that keeps it away from everyone else.

8. Common questions

Can a forgotten photo vault password be recovered?

It depends on the app. If it offers a reset, an email link or an account recovery process, the developer holds something that can restore your access. Use that. If the app encrypts your files with a key made from your password and offers no reset, nobody can recover it. Check the app itself and the developer's support pages for a reset before assuming either answer.

Can Obscura Photo Vault recover a forgotten vault password?

No. There is no reset, no recovery email and no support process that can restore access. Proving who you are does not help. We hold no key, no copy of your data and no account tied to you, so there is nothing that proving your identity would unlock. This is true for every user. We cannot make an exception, because the ability to make one does not exist.

Can Apple recover it?

No. The vault is encrypted on the phone before anything is saved. Anything Apple holds through a device backup is that same encrypted data, which still needs the password.

Will restoring an iCloud backup recover my vault?

It restores the encrypted vault files, not access to them. The backup holds the vault in the same encrypted form it has on the phone, so it still needs the password. Useful after a lost or broken phone. Useless against a forgotten password.

Does Face ID work if I forget my vault password?

No. Face ID fetches the password you already set from the iOS Keychain. It does not make a key of its own. And iOS wipes that stored password when a new face or fingerprint is added to the phone. At that point the password is needed again.

What should I do to avoid losing access to a photo vault?

Save the password in a password manager, and export an encrypted backup file and keep it somewhere safe. Do both, because they fail in different ways. And do not delete the app while you are still trying to remember a password. Deleting it removes the encrypted data with it.

Is a shorter password safer, since I am less likely to forget it?

A password you can actually remember is genuinely better than a stronger one you lose, so the thinking is not wrong. The better answer is a memorable passphrase of several unrelated words, saved in a password manager. That way length is not competing with memory.