How to tell if a vault app really encrypts your files

A lock icon and a PIN screen tell you nothing about whether your photos are actually encrypted. Plenty of "vault" apps just move files to a hidden folder and gate the app. Here are five checks you can do before you trust one.

1. Read the permissions

Check the app's permissions on Google Play. Does a simple photo vault request internet access? If so, ask why - an offline vault doesn't need the network to encrypt a local file. Internet access often means ads, analytics, or cloud uploads. The strongest signal of a privacy-first vault is one that requests no internet permission at all.

2. Look for a named algorithm

Real encryption is specific. Look for AES-256 (ideally AES-256-GCM) stated plainly, and some mention of how the key is derived from your pattern or password (e.g. a KDF like PBKDF2). Vague phrases like "military-grade security" with no algorithm named are marketing, not a spec.

3. Test the "copy it off" question

The decisive test: if someone connected your phone to a computer and copied the app's data folder, could they open your photos? With a real vault, they'd get unreadable ciphertext. With a fake one, they'd get your actual JPEGs. If the app explains that files are stored encrypted on disk, that's what you want.

4. Check what happens to the original

When you add a photo, does the original leave your normal gallery, or is the "vault" just a bookmark pointing at the same unprotected file? A real vault takes ownership of the file and encrypts it; a weak one leaves the original where it was.

5. Ask about recovery

Counterintuitively, an app that can "recover your photos if you forget your password" without a recovery key you control may be storing your files in a way it can read - which means it isn't truly end-to-end. Real encryption has a hard trade-off: lose the key, lose the data. That trade-off is a feature, not a bug.

Quick checklist

• ✅ No unnecessary internet permission
• ✅ Names a real algorithm (AES-256)
• ✅ Files are ciphertext if copied off-device
• ✅ Originals are removed from the gallery and encrypted
• ✅ No "magic" password recovery