What a Photo Vault App Is, and How It Works
A plain definition, the one difference inside the category that matters, and what happens to a photo between import and viewing in an encrypted vault.
A photo vault app keeps photos and videos outside your main library, behind its own lock. The difference that matters is whether the app encrypts the files, so they cannot be read without a key made from your password, or only puts a PIN screen in front of ordinary files. Both look the same from the outside: an icon, a lock screen, a grid. Below: how an encrypted vault actually handles a photo, what it protects against, and what it does not replace.
1. The definition, and the one difference that matters
A photo vault app stores photos and videos in its own space, separate from the Photos app, and needs its own password or PIN to open. That is the whole definition. It covers two designs that behave very differently:
- Vaults that encrypt. Each file is scrambled with a key made from your password. What sits in storage cannot be read without that key. Someone with the unlocked phone, or a copy of its storage, has nothing to look at.
- Vaults that only lock the screen. Files sit in the app's storage as ordinary images. The lock is a screen in front of the app. Someone with a copy of the storage has ordinary images.
Everything else about these apps, the disguises, the decoys, the break-in alerts, the cloud sync, sits on top of one of those two. Our guide to the four kinds of app that hide photos goes through them in more detail. This page describes the first kind, because it is the one the word "vault" suggests.
2. What happens to a photo inside an encrypted vault
We use Obscura Photo Vault as the worked example, because it is the one whose design we can describe with certainty and whose documentation we can link.
- You set a password. The app runs it through a slow process, PBKDF2 at 600,000 rounds with random data mixed in, to make a key. That key does not unlock the photos directly. It unlocks a second, random key, and that second key is what the vault's data is actually encrypted with. The vault does not store your password. If you turn on Face ID, iOS keeps a copy of the password in its Keychain behind Face ID. That is a convenience, not a second key.
- You bring in a photo. The app reads it from your library into memory and encrypts it there with AES-256-GCM, before anything is written to its own storage. What lands on the phone is the encrypted file, its encrypted thumbnail, and an encrypted database entry with its name and album. The original in Photos is untouched.
- You lock the vault. The key is wiped from memory. What is left on the phone is scrambled data and a locked copy of the key that is useless without the password.
- You unlock and view. The password is turned into the key again, the second key is unlocked, and the file is unscrambled in memory to be shown. Video is unscrambled in memory too, for large files one piece at a time as it plays, so no readable copy of a video is written to the phone.
- You delete the original. This is the step the app cannot do for you. Until you delete it from Photos, empty Recently Deleted, and let iCloud catch up, the original is still where it was.
The GCM part of the name matters more than people expect. It means each file carries a check value, so a file that has been altered on the phone fails to open instead of opening as quietly wrong data. What the encryption terms mean explains each one in plain words.
3. What it protects against, and what it does not
| Situation | Encrypted vault |
|---|---|
| Someone scrolling your unlocked phone | Covered; the photos are not in Photos |
| A widget, Memory or search result | Covered; same reason |
| Someone who knows your phone passcode | Covered; the vault has its own password |
| Someone with a copy of the storage or a backup | Covered; they hold scrambled data |
| Someone who knows your vault password | Not covered |
| A phone compromised while the vault is open | Not covered; the key and the readable photo are in memory |
| Screenshots, screen recording, a look over your shoulder | Not covered; that happens after the photo is unscrambled |
| The original still in Photos, iCloud, or a message you sent | Not covered; a vault encrypts its own copy only |
| Someone noticing the app exists | Not covered; a disguise changes the icon, not the record |
Covered means the design deals with the situation. It does not mean any app is beyond attack. That is a separate question no product page can settle.
The lower half of the table is the part that changes decisions, and it is the same for every vault app ever made. A developer who lists it is telling you they have thought it through. Ours is in section 11 of the security paper. Whether these apps are safe at all gets its own answer in are photo vault apps safe.
4. What a vault does not replace
The Hidden album. Most people who use a vault still use the Hidden album, for different photos. The vault takes the few that would matter if the phone were unlocked in someone else's hands. The Hidden album takes the many that just should not pop up in a widget. The two, side by side, and everything the Hidden album does and does not cover.
A backup. An encrypted vault on your phone is one copy, on one phone. If the phone is lost and the vault was never exported, the photos are gone. A vault with no server needs you to keep an export somewhere. A vault with a server needs you to know who holds the keys.
Your memory. If the vault cannot reset a password, nothing else can either. The two habits that cover this are in what happens if you forget your vault password.
5. Common features, explained
Face ID or Touch ID unlock
A shortcut, not a second key. In a well-built vault it fetches your saved password from the iOS Keychain rather than replacing it. iOS takes the shortcut away when a new face or fingerprint is added to the phone.
Decoy vaults
A second vault with a different password, holding photos you do not mind showing. Done properly, the decoy is a real vault, the app shows no list or count, and the files on the phone do not give away which vaults are in use. Done as a marker in a settings file, the marker is the answer. Either way it has known limits. Ours are in plausible deniability in a photo vault.
Disguised icons
The app looks like a calculator or a utility. This changes what a glance at the home screen shows and nothing about how the files are stored. It is useful against a glance and useless against an examination. See how calculator vault apps work.
Folder passwords
A second password on a folder inside the vault. In an encrypted design this means a second layer of encryption with a key made from the folder password, so the folder's contents need both passwords.
Encrypted export
A single file holding the whole vault, encrypted as strongly as the vault itself, which you can import on another device. This is how a vault with no server survives a lost phone. It only counts as a backup once you have tested that it imports.
6. Common questions
What is a photo vault app?
An app that keeps photos and videos outside your main photo library, behind its own lock. The difference that matters is whether the app encrypts the files, so they cannot be read without a key made from your password, or only puts a PIN screen in front of ordinary files. Both look the same from the outside.
How does a photo vault app work?
You bring a photo in from your library, and the app copies it into its own storage. In an encrypted vault, the copy is encrypted at that moment with a key made from your password, and it stays encrypted on the phone. To view it, you unlock the vault. The app unscrambles the file in memory, shows it, and throws the readable copy away when the vault locks. The original in your library is untouched until you delete it.
What is the difference between a photo vault and the Hidden album?
The Hidden album changes where a photo appears in Photos and opens with your phone passcode. A photo vault moves the photo out of Photos entirely and opens with its own password. If the vault encrypts, that password is also the only way to read the file. The Hidden album still syncs to iCloud. A vault decides for itself whether anything leaves the phone.
Where does a photo vault app store your photos?
In its own storage on the phone, separate from your photo library. In an encrypted vault, that storage holds scrambled data rather than images. Vaults built around an account also keep a copy on the developer's servers, which is what makes sync and password reset possible. The App Store listing tells you which design you are looking at, because an account requirement is always stated.
What is a decoy vault?
A second vault, opened by a different password, holding photos you do not mind showing. In a well-built design the decoy is a real vault rather than a fake one, and the app shows no list or count of vaults. So opening the decoy gives away nothing about whether others exist. It has known limits, which a serious developer publishes.
Sources
- Obscura Photo Vault security paper, sections 2 to 5 on primitives, key hierarchy and vault slots
- Security paper, section 11, on what falls outside the threat model
- Apple Support: Hide photos on your iPhone, iPad, Mac, or Apple Vision Pro with the Hidden album
- NIST FIPS 197, the Advanced Encryption Standard
Obscura Photo Vault
An encrypted photo vault for iPhone. Photos and videos are encrypted on your device with AES-256-GCM. There are no accounts, no servers and no analytics, and the app does not require a network connection. If you forget your password, nobody can recover the contents, including us.
View on the App Store →