Is Keepsafe Safe? What the Listing Says and What It Doesn't
Keepsafe is a real, established app, and nothing we found says it is unsafe. But its encryption is named only in general terms, so you cannot check how strong it is.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- It locks photos behind a PIN. It also offers a fake PIN that opens decoy albums.
- The encryption is not described in detail. The pages we checked say "encryption" but name no cipher.
- Cloud backup goes to Keepsafe. Its Private Cloud stores items on the company's servers.
What does Keepsafe say about itself?
We read the Keepsafe website and its App Store listing on 2026-10-23. Check both for current terms.
- Unlock is by PIN. Touch ID is also mentioned.
- A fake PIN opens "decoy albums".
- Photos are "backed up privately". The Private Cloud holds up to 10,000 items.
- The listing says some usage data "may be used to track you across apps and websites owned by other companies".
What can't I check?
Three things are not stated on the pages we read.
- Which cipher is used. AES-256-GCM is a named, public standard. "Encryption" alone tells you nothing.
- Whether you need an account. An account means a server knows something about you.
- Who holds the key to cloud copies. If the company can reset your access, it holds a key.
None of this means the app is broken. It means you are trusting the company's word instead of a published design.
How can I decide?
Ask any vault app the same four questions:
- Does it name its cipher?
- Can it work with no account?
- Is there a published threat model?
- Can the company ever open my photos?
Our guide to vault safety explains each one. If you already use Keepsafe, see how to switch without losing photos.
How is Cryptile different?
- AES-256-GCM on every file, thumbnail and index.
- No account and no server. Keys are derived on your phone from a drawn pattern, and the developer never holds them.
- The core is published for audit, with a threat model and test vectors. Cryptile is new, so it has no long track record.
- Decoy vaults. A different pattern opens a different vault, and there is no vault list.
Cryptile has no cloud of its own and no Android app. Encrypted iCloud backup uses your own iCloud.
What this doesn't protect against
Any vault, ours included, fails if someone watches you draw your code or your phone is compromised while the vault is open. A pattern is weaker than a passphrase, so use 8 or more cells. If you lose both the pattern and the 9-word recovery phrase, the vault is gone. There is no reset.
Do it with Cryptile
Cryptile is free to start, with encrypted iCloud backup included. Plus adds more, and the app tells you when you reach it.