Photo Vault · Security

How Photo Vault protects your files

What is encrypted, by whom, and what Photo Vault does not do. Written for people deciding whether to trust it with private photos, and checked against the app's code for version 1.2.6 (October 2026).

The short version

• There is no account and no server. Your photos and videos are never uploaded, so there is nothing of yours on any computer of ours.
• The vault is encrypted by the iPhone itself with iOS Data Protection, and the files can't be read while the iPhone is locked.
• Backups are a file you create and keep, encrypted with AES-256-GCM under a password only you know.
• Photo Vault does not add its own per-file encryption on top of iOS. Some vault apps do; we say so plainly below.

The files in your vault

Every file on an iPhone is encrypted with its own 256-bit key by the hardware AES engine. What differs between apps is when that key is available, which iOS calls the protection class (Apple Platform Security: Data Protection).

By default, iOS uses Protected Until First User Authentication: after you unlock the phone once after a restart, the files stay readable even when it locks again. Photo Vault sets every file in the vault to Protected Unless Open (NSFileProtectionCompleteUnlessOpen): its key is derived from your iPhone passcode and discarded shortly after the phone locks, so the files are unreadable while it's locked (Apple: Data Protection classes). The one exception is a file that is still being written at the moment you lock the phone, such as a long video import, which finishes saving.

The vault is also excluded from iCloud and computer backups, so your private photos don't end up in a backup you didn't intend.

Locks

• App lock. Face ID, Touch ID or a passcode, asked every time the app comes back to the foreground. The passcode is stored in the iOS Keychain as this device only, when unlocked: it is never written to app storage and never leaves the phone.
• Album passwords. An album can have its own password, stored in the iOS Keychain. It controls who can open the album inside the app; the files in that album are protected the same way as the rest of the vault, not encrypted again with that password.
• Face-down exit and app switcher (optional, in Settings). Turning the phone face down jumps to Safari, Messages or Calendar, and the vault can be covered in the app switcher.

Backups

Because the vault stays out of iCloud backups, Photo Vault lets you export one yourself (Settings → Backup). The file contains every photo and video, your albums and their passwords, and is encrypted as follows:

• The key is derived from the backup password you choose with PBKDF2-HMAC-SHA256, 310,000 iterations and a random 16-byte salt. The password is never stored.
• Content is sealed with AES-256-GCM in 1 MB records. Each record authenticates its position, and the file ends with a closing record, so a backup that was reordered, tampered with or cut short is rejected instead of restored half-way.
• You decide where the file goes: Files, a computer, or your own iCloud Drive. It never passes through a server of ours, and without the password nobody can open it, us included. If you forget the password, the backup can't be recovered.

What Photo Vault connects to

Only Apple's App Store and RevenueCat, the service that handles subscriptions. Neither receives your photos or videos. There is no analytics or advertising SDK, and the App Store privacy label is Data Not Collected.

What Photo Vault does not do

• No per-file encryption of its own. Vault files rely on iOS Data Protection. While your iPhone is unlocked, iOS can read them like other app files; an app with its own encryption layer adds a second key that the vault passcode controls.
• No decoy vault and no intruder photo. Some other vault apps have one or both.
• No automatic backup. If you lose the phone without having exported a backup, the vault is gone.

Who it protects you from

Questions or a security report: sagalabs@proton.me. More about the app: Photo Vault · how it compares.