Behind the scenes
How Velum Encrypts a Photo, Step by Step
By the llcloud team 5 min read
Quick answer
When a photo goes into Velum, it is encrypted on the phone with AES-256-GCM using a key that comes from the pattern you draw, stretched with Argon2id so each guess is slow. Velum then decrypts the stored copy and checks it against the original before it offers to remove the original from your gallery. A 9-word recovery phrase opens the vault if you forget the pattern. Encryption protects what is stored, not an unlocked phone with the vault open, and not copies a cloud backup already made.
"Encrypted" is a word vault apps use a lot, and it does not always mean the same thing. Some apps lock a folder behind a passcode and leave the files inside readable. So rather than ask you to trust a label, here is exactly what happens when a photo goes into Velum, and what that protection can and cannot do.
Step 1: Your pattern becomes a key
Everything starts with the pattern you draw. A pattern on its own is short, far too short to be a key. So Velum stretches it with Argon2id, a method designed to make every guess cost a real amount of time and memory. Velum tunes that cost to your phone when you create the vault, so one guess takes a noticeable moment on purpose.
The result is combined with a key kept in your phone's secure hardware, so a copy of Velum's files alone is not enough to start guessing on another machine. Together they open a random key that belongs to that vault, and from it Velum derives separate keys for the photos, the thumbnails and the vault's list of contents.
You never see any of this. You draw a pattern and the vault opens.
Step 2: The photo is encrypted on the phone
When you import a photo, Velum reads it through Android's own file picker and encrypts it with AES-256-GCM, using Google's Tink library. GCM does two jobs: it scrambles the data, and it adds a check that fails if even one byte of the stored file is changed.
The thumbnail is encrypted too, and so is the file name. Nothing about the photo is stored in readable form, not even what kind of file it is. The encrypted data goes into Velum's private storage on the phone, not into a shared folder, where a cleaner app could delete it by mistake.
Inside that storage, everything is kept in blocks of the same size with random names. Photos, thumbnails and the vault's index all look alike, so the files do not reveal how many photos you have or which is which.
Step 3: The import is checked before anything is removed
This is the step we care about most, because "I lost all my photos" is the review vault apps fear. So while Velum encrypts a photo, it also records a fingerprint of the original. Then it decrypts the stored copy and compares fingerprints. Only when they match does Velum offer to remove the original from your gallery.
Removal goes through Android's own delete dialog, so your phone asks you once to confirm. If Android cannot name a file well enough to delete it, Velum tells you instead of failing quietly. A photo that did not import cleanly is never offered for deletion.
Step 4: The recovery phrase and the backup
When you create a vault, Velum shows a 9-word recovery phrase. It is a second way in, so if you forget your pattern, those words open the vault. Write them on paper and keep them away from the phone.
Backups copy the vault exactly as it is stored, already encrypted. The free backup goes to a folder you choose, such as your phone, a memory card or a USB drive. With Pro, Velum backs up on its own to your Google Drive, in a hidden app space only Velum can read. A new phone does not have the old phone's secure hardware key, so a backup opens with your pattern or your recovery phrase alone.
Step 5: Each pattern opens its own vault
With Pro you can add more vaults, each with its own pattern and its own phrase. A second vault with ordinary photos can serve as a decoy when you must show your phone to someone.
Velum keeps no list of vaults anywhere. Unlocking works by checking whether a key for the pattern you drew exists, among a set of decoy files that are always there. A wrong pattern says "not recognised" and waits the same time whatever was drawn, so the app gives nothing away about what exists.
Pro also has a duress pattern, which opens one vault and quietly removes the keys to every other vault on the phone. Without the keys, those vaults cannot be opened. You set it up yourself, and it cannot be undone.
What can encryption not protect?
Encryption protects data at rest, which means files as they sit in storage. It is not a force field, and we would rather say so up front:
- An open vault is open. If the phone is unlocked and handed to someone with Velum open, they can see what is on screen. Velum locks when the screen turns off and when you leave the app, and you can lay the phone face down to lock it.
- Copies made before are outside its reach. If a cloud service such as Google Photos already backed up a picture, removing it from your gallery does not remove that copy. Our guide on how to hide photos on Android covers how to check.
- Hidden is not invisible. Hidden vaults are not listed anywhere, but anyone who knows Velum exists knows hidden vaults can exist.
- Older backups stay as they were. A duress pattern reaches the folder backup the next time it runs, but copies of a backup you made elsewhere earlier are out of Velum's reach.
- Lost both, lost access. There is no account and no reset email. If the pattern and the phrase are both gone, nobody can open that vault.
- Sharing makes a copy. When you share a photo to another app, Velum hands it a readable copy with its location removed. What that app does with it is up to that app.
How does this compare with other ways to hide photos?
Built-in options take a different approach and can be the right choice. Velum vs Google Photos Locked Folder and Velum vs Samsung Secure Folder compare them, and Velum vs Keepsafe looks at a long-standing vault app.
Two of our free tools fit here as well. The passphrase generator makes strong, memorable passphrases in your browser with nothing sent anywhere, and remove photo location checks whether a picture shows where it was taken and strips that data before you share it.
Sources
Questions
Do vault apps really encrypt photos?
Some do and some only hide them behind a passcode, leaving the original file readable on the phone. Velum encrypts every photo, video, thumbnail and file name with AES-256-GCM before it is stored. You can check it in the app: What others see shows any photo next to the same file as it sits on the phone, which is random noise with no name and no type.
What happens if I forget my Velum pattern?
Your 9-word recovery phrase opens the vault. Velum shows it when you create a vault, and each extra vault has its own. Write it on paper and keep it somewhere safe. There is no account and no reset email, so if both the pattern and the phrase are lost, nobody can open that vault.
Can I lose photos when I move them into a vault?
Velum is built so a failed copy never costs you the original. Every import is decrypted back and compared with the original before Velum offers to remove it from your gallery, and your phone asks you once to confirm that removal. A free encrypted backup to a folder you choose keeps another copy off the vault.
Can someone open Velum if they get my phone?
Not without your pattern or recovery phrase. Wrong patterns cost the same wait whatever was drawn, and the wait grows after five tries. Velum locks when the screen turns off or you leave the app. It cannot protect a phone that is unlocked and handed over with the vault already open.
