Is a photo vault app safe?

The short answer

Some are, and many are not, and the app’s name and its five-star reviews will not tell you which. A safe vault encrypts your photos with a key that comes from your passcode, keeps nothing about you on a server, and lets you check its claims. An unsafe one only puts a lock screen in front of photos that sit in a folder, readable by anyone who can get at the files.

You can tell the difference with a short checklist. It works on any vault app, including ours. Below it we score Bishop Vault against the same list, with its limits.

Why the question is fair

The people who have tested these apps found real problems, mostly on Android, where the files are easier to reach. A security researcher tested 12 top-ranked photo vault apps from Google Play. The researcher reported getting to the stored images in 9 of the 12 just by using a phone that was already logged in. Seven of the apps simply moved the pictures to another folder, and some only renamed them. The page shows no date. It was about Android, so treat it as a warning about the habit. In 2022, university researchers who studied 20 popular Android vault apps reported that most did not set up their disguises well, and that someone with basic knowledge of Android could find the files in most of them.

Those tests were on Android. An iPhone app can still put a lock screen in front of unencrypted files, or send your photos to a server, so check whichever phone you have.

The checklist

1. Can you verify the encryption?

Look for names you can search for: the cipher (for example XChaCha20-Poly1305 or AES-256), the way the passcode becomes a key (Argon2id, scrypt, or PBKDF2), and the library the code comes from. A big phrase with no names is not a check. Better still are published test vectors, a written description of the file format, and a report from someone outside the company. Ask if the encryption covers names, dates, and thumbnails, or only the pictures.

2. Is your passcode part of the key?

In a real vault, the key that unlocks your photos is made from your passcode, so there is no passcode check to get around. If an app lets you reset the passcode by email and still show your photos, the passcode was only a gate and the photos were never locked by it. That is the sign of a lock screen.

3. Is there an account?

An account means the company holds something about you, and often a copy of your files. Ask what is stored, who can read it, and what happens if the company shuts down. No account is simpler, with one trade-off: no one can reset your passcode for you.

4. What does it collect?

Open the app’s App Store page and read the privacy label. Apple requires developers to say what data an app collects, whether it is linked to you, and whether it is used to track you. The developer fills it in, so read it, then read the app’s own privacy policy and see if they agree. Analytics inside a vault app is a red flag. So are ads.

5. Can you get your things out?

Add one test photo, then export it. Can you open the exported copy without the app? Can you make a backup, and what is in it? Be wary of an app that only lets your photos live inside it.

6. How does it treat the passcode?

You can test most of this yourself:

• It should make you choose a real passcode, not four digits.
• Wrong tries should bring longer waits that survive closing the app and deleting it.
• It should lock when you leave it, and the app switcher should show a blank cover, not your photos.
• Nothing from the vault should show up in Photos or Files.
• A biometric unlock should be optional and should ask for the real passcode again after a restart.

7. Where do the backups and copies go?

Find out whether the backup is encrypted, and whether the key travels with it. A backup next to its key is a copy that anyone can open. Also check what your phone’s own backup does with the app’s files.

8. Has anyone outside checked it?

A published report from an independent security firm is the strongest sign. An app that claims a security review but gives you no report to read has told you nothing. If there is no review yet, a trustworthy app says so. We do.

How Bishop Vault scores on its own checklist

1. Verifiable encryption: partly. Each item is encrypted with XChaCha20-Poly1305 in 64 KiB chunks, and your passcode is stretched with Argon2id, both from libsodium. Names, dates, and sizes are inside the encryption, and thumbnails are separate encrypted files. We publish test vectors that a second implementation re-derives. The full written description of the file format is not published yet. How it works has the details.
2. The passcode is part of the key: yes. The vault key is opened by your passcode combined with a long random key made on your device, which is printed in your recovery kit. A copy of the vault files alone is not enough to start guessing passcodes. If you lose the kit and forget your passcode, no one can open the vault, not even Bishop Vault.
3. Account: none. No sign-up, no email, no tracking. No server holds your photos.
4. Collection: none, by design. There is no analytics and no ads. Bishop Vault is not in the App Store yet. When it is, read its privacy label yourself, as the checklist says.
5. Getting things out: yes, with a warning. You can export any item, and make one encrypted backup file. Exported copies are no longer encrypted, so keep them somewhere safe. A backup opens with your passcode together with the long key from your kit, or with your recovery code.
6. Passcode handling: yes. It needs at least 8 characters, with a strength meter. After 5 wrong tries come waits of 30 seconds, then 1, 5, 15, and 60 minutes. The count is stored on your device, so reinstalling doesn’t reset it. It locks every time you leave the app on iPhone and iPad, with a blank cover in the app switcher. Nothing in the vault appears in Photos or Files. Face ID or Touch ID is optional and asks for the passcode again after a restart, after 7 days, and after 5 tries that don’t recognize you.
7. Backups: yes. Backups are files you make and keep yourself. If your device’s own iCloud Backup is on, the encrypted vault files are in it, and the long key is protected so that it works only on the device it was made on, so the files can’t be opened on another device without your recovery kit.
8. Outside review: not yet. No outside security review yet.

Bishop Vault’s code is not public, so you can’t read it yourself. Its limits are the usual ones. It can’t stop spyware already on your device, or someone watching you type your passcode. The next guide covers them in full: what a photo vault can’t protect you from.

When you don’t need Bishop Vault

If you only need to keep a few photos away from someone who borrows your phone, Apple’s locked album in Photos is free and good enough. A vault app is for people who want a separate passcode and real encryption outside Photos. If you would rather use a different vault app, the checklist works on it. If it fails more than one or two of the checks, keep looking. If you are leaving Keepsafe, the Keepsafe comparison puts the sourced facts side by side. The guide to keeping photos private on iPhone lists the free options.

Facts checked on October 25, 2026

• E2E-Assure, Android photo vault app analysis, part 1 (12 apps from Google Play, 9 of 12 reachable with a logged-in phone, 7 only moved files): https://e2e-assure.com/threat-intelligence/android-photo-vault-app-analysis-part-1 (the page shows no publication date).
• Ruffin, Lopez-Toldeo, Levchenko, and Wang, “Casing the Vault: Security Analysis of Vault Applications,” WPES 2022 (20 Android vault apps): https://experts.illinois.edu/en/publications/casing-the-vault-security-analysis-of-vault-applications/
• Apple, App Privacy Details on the App Store (privacy labels are filled in by the developer and shown on each app’s page): https://developer.apple.com/app-store/app-privacy-details/

Keep reading

See how Bishop Vault keeps your things private, or read what a photo vault can’t protect you from and the Keepsafe comparison.