Why Velum Has No Account, and What That Means for Your Photos

Almost every app asks you to sign up. A photo vault is one place where we think that is the wrong default. Velum has no account, no sign-up and no server that holds your photos or your keys. That was a deliberate choice with a real cost, and this post explains both sides.

What would an account have meant?

An account sounds harmless. It gives you a password reset, a sync across devices and someone to email when things go wrong. Every one of those features rests on the same thing: a server that can decide you are you and let you back in.

For a vault, that is the weak point. A server that can reset your vault can be made to reset it for someone else. Someone with access to your email can request a reset. A breach of the server exposes whatever it stored. A legal demand can only be answered with data that exists. And if the service ever shut down, an account tied to it could lock people out of their own photos.

We did not want to build any of that. So we asked a different question: what is the smallest thing that has to exist for you, and only you, to open your vault?

How does Velum work without one?

Two things, both in your hands.

Your pattern is the key. When you draw it, Velum stretches it with Argon2id, a method designed to make each guess cost real time and memory, and combines the result with a key held in your phone's secure hardware. Together they open the random key that belongs to your vault. How Velum encrypts a photo goes through every step. Nothing about it needs a server.

Nine words are the way back in. When you create a vault, Velum shows a 9 word recovery phrase. It opens the vault if you forget your pattern, and it also restores a backup on a new phone. Velum never keeps a copy and cannot show the words again, which is why it asks you to write them on paper, in order, and not in a screenshot, a note or a message. Each extra vault has its own phrase.

The phrase also covers a quieter failure. If a phone ever loses the hardware key Velum keeps, the vault still opens with the recovery phrase, or with your pattern from a backup.

If you think someone has seen your phrase, Velum can make a new one. The old words stop working once you have checked the new ones.

What happens if you lose both?

Then nobody can open that vault. Not you, not a support email, not us.

We say this plainly in the app and on this site, because it is the honest consequence of the design. There is no reset link to send, because there is no account to reset. There is no master key to fall back on, because we never had one. A backup does not change this, since a backup opens with the same pattern or phrase.

We tried to make losing both unlikely rather than pretend it is impossible:

• Velum shows the phrase once, at the moment you create the vault, and asks you to confirm you wrote it down.
• Typing it back is forgiving. Four letters of each word are enough, and a mistyped or swapped word is caught with a clear message instead of a vague failure.
• Wrong patterns cost a wait that grows after five tries, so a slip does not lock you out for good.

Our advice is simple. Write the phrase on paper, keep it somewhere away from the phone, and treat it like a spare house key.

How does this keep your photos away from us?

Your photos are encrypted on your phone before they are stored, and they stay there. They never pass through a server of ours, because there is no server of ours for them to pass through.

Backups follow the same rule. The free backup goes to a folder you choose, such as your phone, a memory card or a USB drive. The Google Drive backup in Pro goes to a hidden app space in your own Google Drive that only Velum can read. In both cases, what is copied is already encrypted, so the backup holds data that means nothing without your pattern or phrase. Our guide to backing up private photos covers the options, and moving private photos to a new phone shows the restore.

Like our other apps, Velum sends anonymous usage counts and crash reports so problems get found. Those events carry no photo, no file name and nothing that counts or tells vaults apart. There are no ads either. We wrote about why our apps have no ads and how the studio pays its way instead.

Is no account really better than a reset email?

For a vault, yes. A reset email means someone else holds a way in: the company, and anyone who gets into your email. With Velum you hold the only keys, and the nine words on paper are what make that safe. Built-in options such as Samsung Secure Folder rely on an account reset, which is exactly the door we chose not to build. How to hide photos on Android shows how they compare.

If you want help making a strong passphrase for something else, our passphrase generator runs in your browser with nothing sent anywhere.

Sources

• Argon2 Memory-Hard Function for Password Hashing (RFC 9106)
• Tink cryptographic library (Google for Developers)