Do Photo Vault Apps Actually Encrypt Your Photos? What 69 App Store Listings Say
Many photo vault apps don’t say whether they encrypt your photos. We read the App Store descriptions of 69 photo vault apps on October 30, 2026. Only 42% mention encryption at all, just 9% (6 apps) name AES, and 4% say “military-grade” instead of naming a cipher. Among the 34 popular apps (1,000+ ratings), only one names AES. Here’s why that matters and how to tell the difference.
Disclosure: we make Easy Vault, which isn’t included in this data. Figures come from each app’s public App Store description. Part of our photo vault app privacy report; download the dataset.
What vault apps claim
| In the App Store description | All 69 apps | 34 popular apps |
|---|---|---|
| Mentions encryption | 42% | 56% |
| Names AES | 9% | 3% (1 app) |
| Mentions 256-bit | 4% | 0% |
| Says “military-grade” | 4% | 6% |
| Mentions end-to-end | 1% | 3% |
| Mentions zero-knowledge | 0% | 0% |
An app may encrypt without saying so, but a description that never mentions it gives you nothing to check.
Hiding vs encrypting
These are very different things:
| Hiding | Encrypting | |
|---|---|---|
| What it does | Puts a passcode screen in front of normal files | Scrambles the files themselves |
| If someone copies the app’s files | They can open the photos | They see unreadable data |
| If the app has a bug or backdoor | Photos may be exposed | Photos still need the key |
| Forgotten passcode | Often resettable by the developer | Only a recovery key can help |
That last row is a useful test: if a developer can reset your passcode and show you your photos again, they don’t need your key, which means the photos aren’t encrypted with something only you hold. See how to recover photos from a photo vault app.
Why “military-grade” tells you nothing
“Military-grade” usually means AES-256, a sound cipher. But the phrase skips the parts that decide whether your photos are actually safe:
- The mode: AES-GCM detects tampering; older modes may not.
- The key: is it derived from your passcode with a slow, memory-hard method like Argon2id, or stored next to the files?
- Each file’s key: does every file get its own key?
- Recovery: is there a recovery key that only you hold?
An app that names these is making claims an expert can check. One that only says “military-grade” isn’t.
What a real encrypted vault tells you
Look for a security page or description that says, in plain words:
- The cipher, for example AES-256-GCM.
- How your passcode becomes a key, for example Argon2id or PBKDF2 with a high iteration count.
- Where keys live, ideally protected by the iPhone’s Secure Enclave.
- What happens if you forget your passcode, ideally a recovery key only you have.
- What leaves your phone, ideally nothing, or backups encrypted on the device first.
Our 7-point checklist for photo vault apps goes through each one.
Easy Vault, which we make, publishes all five: AES-256-GCM with a separate key per file, Argon2id for your passcode, keys bound to the Secure Enclave where available, a recovery key only you hold, and an iCloud backup that’s encrypted before it leaves your iPhone or iPad. Details on our security page.
Methodology
We searched the US App Store for eight vault-related terms on October 30, 2026 and kept the 69 apps that present themselves as photo vaults. Claims were matched in each app’s App Store description (“encrypt”, “AES”, “256”, “military”, “end-to-end”, “zero-knowledge”). This measures what apps say, not what they do. Full method: privacy report.
Related
- Photo vault apps that don’t collect your data
- Photo vault apps with a decoy passcode
- Photo vault app prices compared
Frequently asked questions
Do photo vault apps encrypt your photos?
Not all of them, and many don't say. Of 69 photo vault apps on the US App Store in October 2026, 42% mentioned encryption in their description, 9% named AES, and 4% used the phrase 'military-grade' instead of naming a cipher.
What's the difference between hiding and encrypting photos?
Hiding puts a passcode screen in front of photos that are stored normally, so anyone who gets at the files can view them. Encrypting scrambles the files themselves, so they're unreadable without the key, even if someone copies them off the phone.
What does 'military-grade encryption' mean?
Nothing specific. It's a marketing phrase, usually referring to AES-256, but it doesn't say which cipher, mode or key handling an app uses. Look for a named cipher such as AES-256-GCM and a named passcode method such as Argon2id or PBKDF2.
How can I tell if a vault app really encrypts?
Look for specifics: the cipher (for example AES-256-GCM), how your passcode becomes a key (for example Argon2id), whether there's a recovery key, and a security page explaining it. Vague words like 'secure' or 'protected' without details are a warning sign.