How Do Photo Vault Apps Work? What Actually Happens
A photo vault app copies photos out of your Photos library into the app's own storage, then puts a lock in front of them. That is all some apps do. Better ones also encrypt every file, so the photos are unreadable without a key only you hold.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- A vault is a separate place. Photos in a vault are no longer in your library, so they leave Photos, memories and shared libraries.
- A lock is not encryption. A PIN screen stops casual looking. Encryption makes the files unreadable without the key.
- Who holds the key decides a lot. If the company can reset your lock, the company can get to your photos.
Where do the photos go?
A vault app saves your photos in its own storage, not in the Photos library. Apps you give Photos access to do not see them there.
When you import a photo, the app reads it from your library and writes its own copy. The original stays in Photos until you delete it. Deleted photos then sit in Recently Deleted for 30 days, so that needs clearing too. Our guide to what happens when you delete photos covers it.
What does the lock actually do?
There are two kinds of vault, and they look the same from the outside.
- Hide-and-lock vaults. The files sit in the app's storage as normal images. The PIN or pattern only decides whether the app shows them.
- Encrypting vaults. The files are scrambled with a cipher. Your PIN, pattern or passphrase is turned into the key that unscrambles them.
With the first kind, anyone who gets the raw files sees your photos. With the second, they see noise.
How does encryption in a vault work?
The usual design has three steps.
- You unlock. You enter a code or draw a pattern.
- A key is made. The app turns what you entered into an encryption key. In a careful design this happens on your device, and the key is never sent anywhere.
- Files open as you view them. The app decrypts each photo when you look at it. When the vault locks, it forgets the key.
Thumbnails and search indexes matter too. If an app encrypts photos but stores small previews in the clear, the previews give the game away.
What about backups and new phones?
A vault has to back up somewhere. Some apps upload to their own servers with an account. Others back up to your iCloud.
The question is what the backup contains. An encrypted backup is useless to anyone without your key. That also means a lost key cannot be reset by anyone, so a good app gives you a recovery phrase to write down.
What are decoy vaults?
Some apps let a second code open a second, harmless vault. If someone pressures you to unlock the app, you open that one. It only works if the app does not show a list of vaults.
How does Cryptile work?
- Every file, thumbnail and search index is encrypted with AES-256-GCM.
- Keys are derived on your device from your drawn pattern. There is no account and no server, and the developer never holds your keys.
- A different pattern opens a different vault, with no vault list. File sizes are padded, and decoy slots hide how many vaults exist.
- Backup is an encrypted iCloud backup. Restoring needs your 9-word recovery phrase. There is no reset.
The core is published for audit under a source-available licence, with a threat model and test vectors. Our guide on whether a photo vault app is safe lists what to check in any app.
What this doesn't protect against
No vault protects photos while it is open on screen, or if your phone is compromised by malware at that moment. A pattern is weaker than a passphrase, so use 8 or more cells. If someone watches you draw it, they have your vault. If you lose both the pattern and the recovery phrase, the vault is gone.
Do it with Cryptile
Cryptile encrypts photos as they come in and keeps the key on your phone. Taking photos with its in-app camera means they never touch your library.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos. Plus removes the limits and adds the panic pattern and search inside the vault, for $19.99 a year (7-day free trial) or $39.99 once.