Are photo vault apps safe? What to look for
Safe from whom?
"Safe" depends on who you're worried about.
- Someone borrowing your iPhone for a minute. Almost any vault with its own lock handles this.
- Someone who knows your iPhone passcode. A vault with its own, different lock helps. The Hidden album doesn't, because it opens with your passcode. Here's the comparison.
- Someone with technical tools, or a company that holds copies. This is where the apps differ most, and where you have to ask.
Six questions to ask
- Are the pictures really encrypted? Look for the method named, such as AES-256, done on your phone. A lock screen alone is a door with no walls.
- Does the key depend on your code? If the key sits next to the lock, the lock means little.
- Are previews and names covered too? A small preview can show what's inside.
- What happens when you forget the code? If "forgot code" is solved by an email link or a support request, someone else has a way in too.
- Do pictures go to the company's servers? A cloud copy can be handy, but ask who can read it.
- What happens if you stop paying, or the app is removed? Make sure the pictures can always be saved out.
Here's what each one means in more detail.
What the App Store tells you, and what it doesn't
App Store pages show a privacy section about the data an app may collect, and whether it's linked to you or used to track you. That's useful, but Apple says it is self-reported by the developer. It tells you what the app says it collects. It doesn't prove how well the pictures are protected.
Apple also says sandboxing helps protect user data from unauthorized access by apps. That's a protection between apps. It isn't encryption, and it doesn't decide what the vault app itself does with your pictures.
Warning signs
- "Unbreakable" or "military grade" with no detail.
- A disguise as the main feature, such as a calculator icon. It changes how the app looks, not what protects the pictures.
- No answer to "what if I forget my code?" or "can I get my pictures out?"
- A privacy policy that's missing, vague or hard to find.
- A short code with no waits after wrong tries.
What no vault can fix
Someone who watches you unlock it. Someone who forces you to open it. A copy you already sent to a friend. And you, if you lose the code and have no backup. A vault is one layer. The safest picture is one you didn't need to keep.
How FirstHour answers these
FirstHour's Vault seals each picture, video, file, note and preview on your iPhone with AES-256-GCM. It has its own pattern or PIN, with waits after wrong tries, and your recovery phrase is the only way back in. Nothing is uploaded, and there's no email reset. We can't open it for you.
It can't promise more than that. It has no outside audit yet. If someone sees you draw your pattern, they can open it. Without a backup you save yourself, losing the iPhone loses the Vault. The full list is here.
Questions
Is a free vault app less safe than a paid one?
Not by itself. Ask how it makes money. If the answer involves your data, read the privacy policy closely.
Can I check an app's encryption myself?
Not easily from outside. That's why the questions above matter more than how the app looks.
Sources
- About privacy information on the App Store and the choices you have to control your data, Apple Support
- App security overview, Apple Platform Security