Locks, PINs and recovery · iPhone and Android

I forgot my vault PIN. Can I get my photos back?

You open your vault app, type your PIN, and it is wrong. You try again. Still wrong. Before you try a tenth time or delete the app, it helps to know what kinds of recovery exist, because they lead to very different outcomes for your photos.

What vault apps usually do

Most vault apps fall into one of three groups.

Reset by email or account. You tap “forgot,” the app sends a link or code, and you choose a new PIN. This is easy. It only works because the app’s company can get at your data, or can switch off the lock, without your PIN.

Security question or hint. The app asks something like “What was your first pet?” Answers to these are often easy to guess or find online, so they are a weak lock.

Recovery key or phrase. When you set up, the app gives you a long code or a list of words and tells you to store it. If you forget your PIN, you enter that code. There is no backdoor, so if you lose the code too, the data is gone.

Why an easy reset is a warning sign

The lock on an encrypted vault is mathematical. Your photos are scrambled with a long random key, and your PIN is what unlocks that key. If an app can still open your photos after you forget the PIN, then a second copy of the key, or another way in, exists somewhere. That could be the company’s servers, a spare key stored beside the files, or a flag that simply turns the lock off.

Any of those is also a way in for someone else: a company employee, a person who takes over your email, or an attacker who breaks into the company. Easy recovery and strong privacy pull in opposite directions, and it is fair to ask which one an app picked.

What to do right now

  1. Stop guessing wildly. Some apps lock you out for longer after repeated wrong tries, and a few erase data after too many. Think about the PIN calmly first.
  2. Think about patterns. People often reuse a PIN from a bank card, a birth year, or a street number. Try the ones you would have chosen on the day you installed the app.
  3. Find your recovery code. Check your password manager, the paper you keep important documents on, and any note you made at setup.
  4. Do not delete the app. In many vault apps, the photos live inside the app’s own storage. Removing the app can remove them. Read what happens when you delete a vault app first.
  5. Look for a backup. If you made an encrypted backup, it is still there, but it needs the same recovery code.

How it works in Silo

Silo has no account and no server, so there is no email to send. Instead, the lock screen has a Forgot PIN? Use recovery phrase link. If you use a passphrase, the link reads Forgot passphrase? Use recovery phrase.

  1. Tap the link on the lock screen.
  2. Type your recovery words in order, separated by spaces.
  3. Choose a new PIN or passphrase.

Your photos and files stay exactly as they were. The phrase is shown once, when you set up, and Silo can’t show it again, so keep it somewhere safe. The full story is in what a recovery phrase is and where to keep it.

If you have neither the PIN nor the phrase

For a properly encrypted vault, there is no way in. That is hard to accept, but it is the same property that keeps your photos private from everyone else. Customer support can’t help either, because they never had the key.

If you can still see the originals in your phone’s gallery or have a backup that isn’t in the vault, copy those somewhere safe before you do anything else.

Questions

Can a vault app company reset my PIN?

Only if it keeps a way to open your data without your PIN. That is convenient, but it also means the company, or anyone who breaks into its systems, could read your photos. A vault that truly can't reset your PIN has no such way in.

How many wrong PIN guesses are allowed?

It varies by app, and some allow unlimited tries. A longer PIN and a slow key derivation matter more than a guess counter, because a counter can be bypassed by someone who copies the files off the phone.

Will reinstalling the app get my photos back?

Usually not. Many vault apps keep the photos inside the app's own storage, so deleting the app can delete them too. Look for a backup or a recovery option before you remove anything.

What if I lost my PIN and my recovery phrase?

In a properly encrypted vault, the files can't be opened by anyone. If you have an encrypted backup, it needs the same phrase, so it won't help either.

Does Silo let me change my PIN afterward?

Yes. After you enter your recovery phrase, Silo asks you to choose a new PIN. Your photos and files are not changed.

Sources

  1. NIST SP 800-63B: Digital Identity Guidelines, authentication and lifecycle management
  2. Silo vault format, version 1, section 4: from the recovery phrase to the master key