Photo vault encryption and zero-knowledge, explained

A photo vault app that encrypts your photos turns the files themselves into unreadable data, and only the right key turns them back. A vault that only hides them puts a PIN screen in front of ordinary image files. "Zero-knowledge" adds one more promise: the company behind the app never has your key, so it cannot read your files even if it wanted to. This guide explains the terms and gives you six questions to ask any vault app. Stash: Calculator Photo Vault, our pick (we build it), encrypts every item on the device with AES-256, keeps the key in the iOS Keychain and has no server, so it is zero-knowledge by design.

Disclosure: I build Stash, a photo vault app. Where this page mentions other apps, the facts come from the vendor's own pages, read on 8 October 2026, re-checked on 10 October 2026 and linked. Where it describes Stash, the facts come from our product facts page and privacy policy.

Competitor details last checked: 2026-10-10, from each vendor's own pages.

Hiding vs encrypting

Hiding means the app keeps photos out of your camera roll and asks for a PIN before it shows them. The files on the phone's storage can still be normal photos. Anyone who gets past the PIN screen, or reads the storage another way, sees them.

Encrypting means each file is scrambled with a key before it is saved. Without the key, the file is noise. The PIN screen is then the door, and encryption is the safe behind it.

Both are useful. Hiding stops someone scrolling your phone. Encryption also covers the files themselves. A vault page that says only "secure" or "protected" does not tell you which one you get.

What AES-256 means

AES is the encryption standard most apps use; 256 is the key length in bits. A 256-bit key is far too large to guess by trying every possibility. When a vault says "AES-256", it is naming a well-studied method, which is a good sign.

Some vendors also name the mode and how the key is made from your password. For example, Obscura says it uses "AES-256-GCM with 600,000-round PBKDF2 key derivation" on obscura-vault.com (vendor site, checked 2026-10-10), and Vaultaire names AES-256-GCM on vaultaire.app (vendor site, checked 2026-10-08). The more a vendor names, the more an expert can check.

What AES-256 does not protect against:

• A weak or shared PIN. If someone knows your PIN, encryption opens for them as it does for you.
• An unlocked, open vault. While you are looking at a photo, it is decrypted on screen.
• Screenshots and copies. A photo you share, screenshot or leave in your camera roll is outside the vault.
• The original in Photos. Many vaults copy a photo in; the original stays in Photos until you delete it.

Where the key lives

Encryption is only as private as the key. There are three common places:

1. On your device, for example in the iOS Keychain, Apple's protected store for secrets.
2. Derived from your password or pattern, so the key is rebuilt each time you unlock (Vaultaire says a drawn pattern derives its key).
3. On the vendor's server, which means the vendor could, in principle, decrypt your files.

The first two can support zero-knowledge. The third cannot.

What "zero-knowledge" means

Zero-knowledge means the company behind the app cannot read your files because it never receives them in readable form and never holds the key. Two ways to get there:

• No server at all. Files stay on your phone, encrypted. Obscura, for instance, says "There is no server."
• Encrypt before upload. If there is a cloud backup, files are encrypted on the device first, with a key the company does not have. Proton says files are encrypted on your device before upload "so only you hold the keys" on proton.me/drive (vendor site, checked 2026-10-10), and Private Photo Vault says its Cloud Vault encrypts files before upload and "Only you hold the key" on privatephotovault.com (vendor site, checked 2026-10-08).

The trade-off: if the company cannot read your files, it also cannot rescue them. Forget the PIN and lose the recovery key, and the files stay locked.

Marketing words are not a specification

Some vault pages describe their encryption with labels that borrow prestige from armies or banks. Those labels are not a standard and tell you nothing you can check. Ask instead for two things: the algorithm (for example AES-256) and who holds the key.

How to check a vault app yourself

You do not need to be a security expert to do a first check:

• Read the vendor's security or privacy page. Look for the algorithm, where the key lives, and whether files leave your phone.
• Read the App Store privacy label. Apple's "App Privacy" section on each listing shows what data the app says it collects. Fewer categories is a reasonable start.
• Look at the backup settings. Is cloud backup on by default? Is it encrypted before upload? Does it go to your own account or the vendor's?
• Optional, for the technical: with a Mac and file-inspection tools, you can look at an app's stored files and see whether they are readable images. iOS keeps apps sandboxed, so this is harder than it sounds and not needed for most people.

What each vault app says it collects (App Store privacy labels, read 10 October 2026)

An App Store privacy label is the developer's own declaration of what data the app collects. We first read each app's App Store page on 8 October 2026 and re-checked each label on 10 October 2026. Method of the first read, from our dataset notes: "each page was fetched on 2026-10-08 with WebFetch (page converted to text, fields extracted by a model); nothing is taken from third-party listicles." The extraction was model-assisted and not re-checked by hand. "n/a (not shown)" means the page did not show that field; it does not mean the app lacks the feature. Apple's Hidden album and Proton Drive are not in this dataset. Stash's row is copied exactly as the store shows it.

App	Privacy label as shown	Decoy PIN	Break-in alert	Cloud backup	Lifetime option
Private Photo Vault	Data used to track you: Usage Data. Linked to you: Purchases (Purchase History); User Content (Photos or Videos); Identifiers (User ID, Device ID); Usage Data (Product Interaction, Advertising Data); Diagnostics (Crash Data, Performance Data)	yes: Decoy password	yes: break-in report with photo and GPS	yes: encrypted cloud backup	no item named lifetime
Keepsafe	Data used to track you: Usage Data. Not linked to you: Usage Data; Advertising Data	not stated by Keepsafe	products page: "Track break-in attempts" (Premium); photo not stated	yes: Backup / Private Cloud features	no
Obscura Photo Vault	Data not collected: The developer does not collect any data from this app	separate vaults (Pro) can serve as a decoy, per the developer's reply on the listing; Calculator Mode removed in version 1.13.3	n/a (not shown)	no: description says "No cloud"	yes
Vaultaire	Linked to you: Contact Info (Email Address); User Content (Customer Support). Not linked to you: Usage Data (Product Interaction); Diagnostics (Crash Data, Performance Data, Other Diagnostic Data)	yes: decoy vault + duress vault (Pro)	n/a (not shown)	yes: encrypted iCloud backup	yes
Safety Photo+Video	Data not collected: The developer does not collect any data from this app	yes: separate decoy vault with a different password	n/a (not shown)	yes: optional zero-knowledge cloud backup	not stated (an "iCloud Sync Lifetime" item for sync; Pro upgrade type not stated)
Calculator#	Data used to track you: Contact Info. Not linked to you: Contact Info (Email Address); User Content (Photos or Videos)	no decoy PIN shown (Disguise Mode: fake error message)	yes: Hack Monitor (reports invalid password attempts)	yes: iCloud, Dropbox, Google Drive, OneDrive	no
LockMyPix	Data used to track you: Identifiers. Not linked to you: Third-Party Advertising: Identifiers, Device ID; Analytics: Purchases, Usage Data, Diagnostics (Performance Data); App Functionality: Purchases, Usage Data, Diagnostics (Crash Data)	yes: decoy Fake Vault with a separate code	yes: intruder selfie	yes: iCloud backup	yes
Stash	Linked to you: Contact Info (Email Address). Not linked to you: Purchases (Purchase History); User Content (Emails or Text Messages); Identifiers (User ID)	yes: second PIN opens a separate empty vault	yes: front-camera photo	yes: encrypted backup to iCloud or Google Drive	yes

Sources: each app's US App Store page (Private Photo Vault, Keepsafe, Obscura, Vaultaire, Safety Photo+Video, Calculator#, LockMyPix, Stash), checked 2026-10-10. "Lifetime option" means the listing shows an in-app purchase named lifetime or the vendor states a one-time price; prices are left out. Obscura note: its listing says "Calculator Mode has been removed to meet App Store requirements" (version 1.13.3); its website says vault data is included in iCloud Backup by default.

Six questions to ask any vault app

Question	Good answer	Warning sign
How are files encrypted?	Names an algorithm, for example AES-256	"Secure", "protected" or a marketing label only
Where does the key live?	On your device or derived from your password	On the vendor's server, or not stated
Do files leave the phone?	Only if you turn on backup	Uploaded by default with no detail
Is the backup encrypted before upload?	Yes, with a key the vendor does not hold	Not stated
What if I forget the PIN?	A recovery key or phrase you keep	"Contact us and we will open it" (then the vendor can)
Has the claim been checked independently?	Names the audit or test	No mention, which is common; weigh the other answers

What Stash states

• Encryption: every item is encrypted on the device with AES-256 before it is saved.
• Key: the key stays in the iOS Keychain.
• Zero-knowledge: there is no Stash server that receives vault files; the developer cannot see, scan or recover them.
• Forgotten PIN: a recovery key is shown once at setup. Without the PIN or that key, we cannot open the vault for you.
• Backup: optional and encrypted, to your own iCloud Drive or Google Drive, started by you, never automatic (Premium).
• iCloud Photos: vault files sit in the app, not in the Photos library, so iCloud Photos does not upload them.
• No analytics or ads: the app uses no analytics frameworks and shows no ads.

What Stash does not claim: an independent security audit. And importing copies a photo, so the original stays in Photos until you delete it there and empty Recently Deleted.

Stash adds a second lock for the items you choose. It does not replace a strong device passcode, and it does not protect against someone who has your unlocked phone and knows your PIN.

FAQ

Do photo vault apps actually encrypt photos?

Some do and say exactly how; others only hide photos behind a PIN screen. Look for a named algorithm such as AES-256 and a clear statement of where the key lives. Our 7-app comparison lists what each vendor states.

What does zero-knowledge mean in a photo vault app?

The company behind the app never receives your files in readable form and never holds your key, so it cannot read them. The flip side is that it cannot recover them if you lose your PIN and recovery key.

Is AES-256 enough to keep my photos private?

It protects the stored files well. It does not protect against a weak or shared PIN, an unlocked vault, screenshots, or originals left in your Photos library.

Is Keepsafe zero-knowledge?

Keepsafe's products page, read on 10 October 2026, names "AES-256, on the device and in your private backup", but does not say who holds the key. Ask Keepsafe directly, or compare options in Keepsafe alternatives for iPhone.

Is the iPhone Hidden album encrypted?

Apple's Hidden album support page (vendor site, checked 2026-10-10) says the album is locked by default and opens with Face ID or Touch ID. It does not describe a separate encryption key or password for the album.