How do photo vault apps work?

Open a vault app and it feels like a safe: you type a PIN, and your photos are there. Behind that screen, though, things can be built in very different ways. Knowing the basics makes it easy to tell a real safe from a curtain.

Step one: the photos are copied in

Phones keep each app’s data in a private area that other apps can’t read. A vault app uses that area as its storage. When you import a photo, the app copies it from your photo library into its own space. It can’t simply move your photo, so the original stays in your library until you delete it, or until the app offers to remove it for you.

This is the part where photos get lost in careless apps, which is why moving photos into a vault safely has its own guide.

Step two: the lock

What happens next separates the two kinds of app.

Hiding

The app keeps the photo as an ordinary file in its storage and shows a lock screen in front. Opening the app with the right PIN displays the file. The lock is a door in front of an unlocked room. It stops someone browsing on your phone. It doesn’t stop anyone who can read the stored files by other means, such as through a computer connection or a copy of the phone’s data.

Encrypting

The app scrambles the file before it is written, using a secret key. The stored file is unreadable without that key. Your PIN doesn’t encrypt the file directly. Instead:

1. The PIN is turned into a long key by a slow, memory-hungry function (Argon2 is a well-known one). Slowness is the point: it makes each guess cost an attacker real effort.
2. That key unlocks a master key, which in turn unlocks your files.
3. Because of the slow function, a short PIN is weaker than a long passphrase. A good app asks for six or more digits, or offers a passphrase.

Because there is a master key in the middle, you can change your PIN without re-encrypting every photo, and a recovery phrase can rebuild the master key if you forget the PIN. See what is a recovery phrase.

Step three: viewing without leaving traces

To show you a photo, the app has to decrypt it. How it does that matters. A careful app decrypts in memory and shows the result without writing a readable copy to storage. A careless one writes a temporary plain file, which defeats the encryption. When the vault locks, the app should clear the keys and viewing data from memory.

You can’t see this from outside, which is why a published description of the design is a good sign. Are photo vault apps safe lists what to look for.

Where vaults go wrong

• Disguise without encryption. A calculator or notes look doesn’t protect files. Calculator vault apps explains what disguise does and doesn’t do.
• A cloud account in the middle. If your photos sync through the company’s servers, your privacy depends on them.
• No way out. An app with no export holds your photos hostage.
• Weak recovery. If support can reset your PIN, they can open your files.
• Deleting the app. Uninstalling usually deletes the vault with it.

What a good one looks like

It encrypts on the phone before writing anything, uses well-known algorithms, needs no account, has an export, tells you what uninstalling does and says how it handles a forgotten PIN.

Silo, an encrypted vault for iPhone and Android that is coming soon, follows this design and publishes the file format so anyone can check it.