Hiding is not encrypting
There are two very different kinds of "vault":
- Hide-behind-a-PIN apps store your photos as ordinary files inside the app and show a lock screen in front of them. Someone who can read the app's storage, through a backup, a forensic tool or a bug, may see the photos.
- Encrypting vaults turn each file into ciphertext with a key derived from your unlock. Without the key, the files are noise.
The App Store listing usually tells you which kind you have. Look for a named algorithm such as AES-256-GCM or ChaCha20-Poly1305 and a description of where keys live. "Military-grade encryption" with no detail tells you nothing.
Five questions to ask
- Where does encryption happen? It should be on your device, before anything is written or backed up.
- Who holds the keys? If support can reset your password by email, the company has a way in.
- Does it need an account? An email links your identity to the fact that you use a vault.
- Does it show ads? Ad SDKs collect device data and run third-party code inside the app.
- How do you recover access? A recovery phrase or encrypted export you control is a good sign.
Red flags
- A free tier funded by ads.
- Mandatory sign-up before you can lock anything.
- Cloud storage on the developer's servers with no mention of client-side encryption.
- Vague claims ("unhackable", "military-grade") and no security page.
- The app copies photos into the vault and never mentions deleting the originals.
Even a good vault has limits
No app can stop someone photographing your screen, and none can protect a file you have opened on an unlocked phone. If someone knows your vault code, they can open it. That is why VaultBolt adds a decoy vault and duress code, and why it publishes its honest limits.
Where VaultBolt stands
VaultBolt encrypts every file, thumbnail and its index with AES-256-GCM on the device. Keys come from your unlock through Argon2id and a Secure Enclave secret. There is no account, no ads and no server that can read your files. An independent audit and a public whitepaper are planned before public launch.
Frequently asked questions
Can photo vault apps see my pictures?
Apps that encrypt on your device with keys only you hold cannot. Apps that store photos on their own servers, or can reset your password by email, may be able to.
Can police or a forensic lab open a photo vault?
With strong on-device encryption and a strong passphrase, extracting files from storage is very hard. Weak PINs on a compromised device are easier to guess. Laws on compelled unlocking vary by country.
Can a photo vault app be hacked?
Any app can have bugs. Reduce the risk with an app that documents its encryption, gets independent audits, and keeps nothing readable on its servers.
