Privacy and security
How to Choose a Photo Vault App for Android: 8 Checks
By the llcloud team 7 min read
Quick answer
Pick a vault that encrypts each file on your phone and names its cipher, derives the key from your own code, gives you a recovery method that needs no company, and backs up encrypted copies you can restore on a new phone. Avoid apps that only hide files in a folder, say "military-grade" without details, or keep your photos only in their cloud.
A photo vault asks for a lot of trust. You hand it the pictures you least want anyone to see, and you delete the originals from your gallery. Most vault apps look alike in the store: a lock icon, a passcode screen, a promise of privacy. The differences that matter are hidden in how they store files, and you usually find out only when something goes wrong. These eight checks help you tell them apart before you move a single photo.
Are photo vault apps actually safe?
The honest answer is that it depends on what the app does with the file. There are two very different designs behind the same lock screen.
| Hidden folder with a lock | Encrypted vault | |
|---|---|---|
| What happens to the file | Moved or renamed, still readable | Scrambled with a key |
| A file manager or computer can open it | Often yes | No, it reads as noise |
| The lock screen protects | The app's screen only | The file itself |
| Forgetting the code | Sometimes a reset email | Needs a recovery method |
A hidden folder keeps casual eyes out of your gallery. An encrypted vault keeps the file unreadable even when someone has the storage in their hands. If your photos matter, you want the second design. Our guide on how to hide photos on Android covers the free built-in ways to simply hide them.
What should you check before you trust a vault?
1. Real encryption, with the cipher named
A trustworthy vault names its cipher. AES-256-GCM, for example, both encrypts a file and detects if it was changed. Check that thumbnails and file names are encrypted too, because a thumbnail is a small copy of your photo and a file name can say a lot. The best sign is a vault that lets you see the stored file for yourself.
2. Where the key comes from
The key should come from your own code, stretched by a slow function such as Argon2id so that guessing every pattern or PIN takes a long time. A vault that keeps its key on a server, or uses the same key for everyone, leaves your files open to whoever gets that key.
3. What happens if you forget the code
This is the check people skip, and the one that costs the most. Ask what the app does when you forget your PIN or pattern. Google says that if you forget your Files by Google Safe folder PIN or pattern, you cannot access your files, and resetting it permanently deletes them. Samsung Secure Folder can be reset with a Samsung account, but only if you turned that on at setup. A vault with real encryption and no account must give you a recovery method you hold, such as a written phrase.
4. Backup and moving phones
A vault with one copy on one phone is one dropped phone away from losing everything. Check that the app can back up, that the backup is already encrypted, and that it restores on a new phone. Google says Back up to Google Drive is not available inside Safe folder, and that you should not copy Safe folder files from an old phone to a new one. Google Photos Locked Folder can back up, but only if you turn backup on. Our guides on backing up private photos and moving private photos to a new phone show what to look for.
5. Decoy and disguise
If someone may pressure you to unlock your phone, a decoy vault helps: a second code that opens a vault of ordinary photos. A disguise swaps the vault icon for something plain. Both have limits, so read what a decoy vault can and cannot do before relying on one.
6. Account and cloud
An account is not bad in itself, but notice what it means. Who can reset your vault? Where do the files live? A vault that stores your photos only in its company's cloud puts them on someone else's computer. Prefer a vault that works on the phone first and treats cloud backup as an encrypted copy you choose.
7. Ads and trackers
A vault full of ads runs other companies' code next to your most private photos. Read the Data safety section on the app's Play listing and check what it collects and shares. Fewer data types is better.
8. What happens on uninstall
Find out where the files go when the app does. Google says Locked Folder items you have not backed up are lost if you uninstall Google Photos, and the Files by Google Help Community says uninstalling Files by Google permanently deletes Safe folder files. Whatever you choose, keep an encrypted backup outside the app.
What does the checklist look like?
Use this table on any vault you are considering. Velum is our encrypted vault for Android, and this is how it answers each check.
| Check | What a good answer looks like | Velum |
|---|---|---|
| Encryption | A named cipher, per file | ✓ AES-256-GCM via Google Tink |
| Thumbnails and names | Encrypted too | ✓ |
| Key | From your code, slow to guess | ✓ from your pattern, Argon2id |
| Proof | You can see the stored file | ✓ "What others see" |
| Forgotten code | Recovery you hold | ✓ 9 word recovery phrase |
| Backup | Encrypted, outside the phone | ✓ folder, memory card or USB free, Google Drive with Pro |
| New phone | Restore with your code | ✓ pattern or recovery phrase |
| Safe import | Checked before originals go | ✓ every import checked against its original |
| Decoy and disguise | Separate codes, plain icon | ✓ decoy vaults and disguise (Pro) |
| Account | Optional or none | ✓ none |
| Ads | None | ✓ none |
What are the red flags?
- A calculator that only hides. Plenty of apps look like a calculator and open a gallery when you type a code. The disguise is the whole product. If the app never says how the files are encrypted, assume they are only hidden.
- "Military-grade" with no cipher. It is a marketing phrase. Real encryption has a name, and an app that uses it is usually happy to say which.
- Cloud-only storage. If your photos live only on the company's servers, your privacy depends on their security and their future.
- No word on a forgotten code. If the app never explains recovery, you will find out the hard way.
- Deleting originals without checking. A vault should confirm that the copy is good before your gallery copy goes.
- Unlimited free with heavy ads. Someone pays for storage and development. If it is not you, ask who.
How do the built-ins measure up?
Your phone may already have a private space. Google Photos Locked Folder hides photos behind your screen lock and can back up to Google Photos if you turn that on. Google says people who have access to your screen lock can unlock it. Samsung Secure Folder is a separate space for files and apps on Galaxy phones, though Samsung says backing up data is no longer supported for it. Files by Google Safe folder adds a PIN or pattern to files you choose.
These are handy for hiding everyday things. For the files you cannot replace, add a vault that passes every check above. Our comparisons go deeper on Velum vs Google Photos Locked Folder, Velum vs Samsung Secure Folder and Velum vs Files by Google Safe folder.
How does Velum pass every check?
Velum encrypts every photo, video, thumbnail and file name on your phone with AES-256-GCM, using a key from your pattern stretched with Argon2id. "What others see" shows any photo beside its stored version, which is random noise. Every import is decrypted back and checked against the original before Velum offers to remove it from your gallery. A 9 word recovery phrase opens the vault if you forget your pattern. There is no account and no ads. Our post on how Velum encrypts a photo explains each step.
Velum has limits too. It needs Android 11 or newer. Someone who watches you draw your pattern can open the vault. If you lose both the pattern and the phrase, nobody can recover the files, including us. The free version holds up to 100 photos or files and 10 videos in a vault, and Pro, by month or year with a 7-day free trial or once for life, removes that limit.
Sources
Questions
Are photo vault apps safe?
Some are and some are not. A safe vault encrypts each file on your phone with a named cipher, using a key that comes from your own code, so the stored file is unreadable without it. Many vault apps only move photos into a hidden folder behind a lock screen, and anyone with a file manager or a computer may find them. Check the app's own description for the cipher and the key.
How can I tell if a vault app really encrypts my photos?
Look for three things. The app names its cipher, such as AES-256-GCM, rather than saying only "military-grade". It explains where the key comes from. And it gives you a way to see the stored file. Velum's "What others see" screen shows any photo next to the same file as stored on your phone, which is random noise with no name and no type.
What happens if I forget my vault code?
It depends on the vault. Files by Google Safe folder has no recovery, so a forgotten PIN or pattern locks the files away. Samsung Secure Folder can reset with your Samsung account if you turned that on at setup. A vault with no account needs its own recovery method. Velum gives you a 9 word recovery phrase when you create a vault.
Do I lose my photos if I uninstall a vault app?
With many tools, yes, if there is no backup. Google says unbacked Locked Folder items are lost if you uninstall Google Photos, and its help community says uninstalling Files by Google deletes Safe folder files. Before you trust any vault, make an encrypted backup that lives outside the app, on a memory card, a USB drive or your own cloud storage.
Should a photo vault need an account?
Not necessarily. An account can help with recovery, but it also means a company holds something tied to your vault. A vault with no account keeps everything on your phone and needs a recovery method you hold yourself, like a written phrase. Velum works with no account and no sign-up, and needs Android 11 or newer.
