Are photo vault apps safe?

“Safe” depends on who you’re worried about. A vault that stops a nosy friend may do nothing against someone who has your email password. The good news is that most of what you need to judge an app is public, in its store listing and help pages. Here’s how to read them. App details below were checked on 24 October 2026 in the US stores.

Decide what “safe” has to mean for you

Think about four kinds of risk:

1. Someone picks up your unlocked phone. Almost any vault, or a built-⁠in hidden folder, handles this.
2. Someone knows your phone’s passcode. You need a vault with its own PIN, pattern or password. Apple’s Hidden album and Google’s Locked Folder open with the phone’s own lock.
3. Someone gets into your email or cloud account. This depends on how the app handles accounts, recovery and backups.
4. The app maker, its servers or its advertising partners. This depends on who holds the keys and what the privacy label says.

The checks below cover risks 2 to 4.

Check 1: read the privacy label

On the App Store, the listings for these apps show a privacy label with sections such as Data Used to Track You, Data Linked to You and Data Not Linked to You. For the apps covered here:

• Keepsafe lists usage data (advertising data) under Data Used to Track You, for third-⁠party advertising.
• Private Photo Vault lists advertising data used to track you, and photos or videos, a user ID and a device ID as data linked to you.
• LockMyPix lists a device ID used to track you.
• Calculator# lists an email address used to track you.
• Vaultaire and Hide it Pro show no tracking section.

On Google Play, be careful with the Data safety section. Google says its encryption line is about data in transit, not files stored on your phone. So “Data is encrypted in transit” doesn’t tell you whether the vault encrypts your photos, and “Data isn’t encrypted”, shown on the Play listings for Calculator# and Hide it Pro, is also about transit.

Check 2: does the maker name its encryption?

A named method and a plain explanation of where the key comes from is a better sign than words like “hides” or “protects”. Here’s what each maker states:

• Vaultaire: AES-⁠256-⁠GCM. A key derived from your pattern with PBKDF2-HMAC-SHA512 wraps a separate random master key.
• LockMyPix: every imported photo, video or document is encrypted with AES CTR 256.
• Private Photo Vault: AES-⁠256, with a vault passcode that can differ from your phone’s.
• Keepsafe: 256-⁠bit AES at rest, in a help article last edited in December 2019.
• Calculator#: no method named for photos and videos. The App Store listing talks about hiding and password protection; the maker’s website says it encrypts documents.
• Hide it Pro: the website says your data is encrypted on your device, with no method named.

A named method is a claim, not proof. It tells you what the maker is willing to be held to.

Check 3: account and recovery

Ask one question: if I forget my PIN, who can let me back in?

• Keepsafe asks for your name and email at setup and resets a forgotten PIN with an access code sent to that email.
• Calculator# says you can retrieve a lost password through your registered email.
• LockMyPix makes email recovery optional. Without it, the docs say, there’s no backdoor.
• Vaultaire gives each vault a recovery phrase and says it doesn’t store keys.

If the answer is “the company, through my email”, then your email account is part of your vault’s lock. Anyone who gets into that inbox may be able to use the same reset. That can be a sensible trade for convenience, but make it knowingly, and secure the email account well.

Check 4: backups and who holds the keys

Backups are where many vaults hand your photos to someone else’s computer. Look for where copies go and who can decrypt them:

• Keepsafe backs up to its own cloud: 200 items on the free plan, up to 10,000 with Premium. It says no admins or employees can view your content, but doesn’t say who holds the keys.
• LockMyPix backs up, as a Premium option, to your own Google Drive or iCloud, encrypted with your vault password.
• Vaultaire encrypts its iCloud backup on your phone, and says Apple stores the encrypted copy without receiving the key in readable form.
• Private Photo Vault’s Cloud Vault is optional and Premium. The maker says only you hold the key, and that your cloud backup is deleted if you move from an expired Premium plan to Basic.
• Calculator# and Hide it Pro offer cloud backup without saying who holds the keys.

For comparison, Apple says iCloud Photos under standard data protection is encrypted with keys Apple holds, and becomes end-⁠to-⁠end encrypted only if you turn on Advanced Data Protection.

What independent testing exists

In November 2015, IOActive published a test of the free iOS versions of Keepsafe and Private Photo Vault. In the Private Photo Vault version tested, stored photos were not encrypted and the passcode was stored in plain text. In Keepsafe, tested on a jailbroken iPhone 4S running iOS 7.1.2, the lock screen could be bypassed and album passwords came back from the server in plain text.

That was almost 11 years ago. Both apps have changed since, and Private Photo Vault now states AES-⁠256. We couldn’t find a newer named, independent test of these apps. So treat the 2015 results as history, not as a verdict on today’s versions, and lean on what makers state now.

A five-⁠minute checklist

Before you move anything private into a vault app:

• Read the App Store privacy label and note anything under Data Used to Track You.
• Search the help center for “encryption” and write down the method named, if any.
• Find out whether it needs an account, and what for.
• Find the forgotten-⁠PIN page: email reset, recovery phrase, or nothing?
• Find the backup page: where do copies go, and who holds the key?
• Check the date on the help pages you read.

If you can’t find the answers, email the developer and ask. A vault maker that can’t explain how it protects your photos has told you something useful.