Are photo vault apps really encrypted, and what does AES-256 mean?

Almost every vault app’s listing promises encryption, often with a big word in front of it. Keepsafe’s App Store listing says “military-grade encryption”. LockMyPix says “TRUE AES encryption” and “the same encryption that is used by banks and governments worldwide”. These claims can all be true and still tell you little. This guide explains why, and what to check instead. We read each listing and help page on 2026-10-09.

What AES-256 is

AES is the Advanced Encryption Standard. NIST publishes it as FIPS 197, which specifies three versions: AES-128, AES-192 and AES-256. NIST says each one “transforms data in blocks of 128 bits”, and “the numerical suffix indicates the bit length of the associated cryptographic keys”.

It is the normal cipher for stored data. Apple says an iPhone with a passcode “encrypts your iPhone data with 256-bit AES encryption”. So “a vault with AES-256” is like “a car with wheels”. It is expected, and it is not where vaults differ.

What the apps say

App	Encryption claim	Source
Keepsafe	“Industry-standard 256-bit AES encryption”, files “encrypted at rest”	Keepsafe help center
LockMyPix	“AES CTR”	App Store listing
Vaultaire	“AES-256-GCM”, with “a random key” that “your pattern unlocks”	App Store listing
Private Photo Vault	A Cloud Vault Password “used as a secret value that only you know to encrypt/decrypt your files”, for its cloud backup	App Store listing
Privault	“The encrypted storage can be accessed only when you enter your particular digit-passcode”	App Store listing

None of these tells you the part that matters most: what protects the key.

The key is the whole story

Encryption turns a photo into noise that only the right key turns back. Every question about a vault is a question about that key:

• What unlocks it? Your code, a face, an email link, a security question or a support ticket.
• Where does it live? On the phone in a hardware-protected store, in the app’s files, or on a server.
• Can it be copied? To a backup, to a computer or to a new phone.

The recovery flow answers most of these. Look at two apps’ own pages:

• Keepsafe says its files can only be decrypted by unlocking with your PIN or Face ID. It also says a forgotten PIN is reset with an access code sent to your email. If an email code can lead back to your files, the key does not rest on your PIN alone. Your email account becomes part of the lock.
• LockMyPix says its email recovery ends with “Your password will be displayed”. An app that can show you your old password keeps it in a form it can read.
• Calculator Lock’s listing gives a master reset code, “11223344=”, plus a security question. The question is then the real lock.

None of these makes the cipher weak. They show where the cipher stops mattering.

Five questions that test an encryption claim

1. If I forget my code, what can the app do? “Nothing without your recovery key” means the key is yours. “We email you a code” means someone else can reach it.
2. Does the app ever show my old password? It should never be able to.
3. Are file names and thumbnails encrypted too? A vault that encrypts photos but leaves names or previews readable leaks what you keep.
4. Is the cloud backup encrypted before it leaves the phone? And with which key?
5. Has anyone outside the company checked it? A published design or an outside audit beats any adjective.

Our guide to whether photo vault apps are safe covers the checks that are not about encryption.

Your phone already encrypts. Why a vault?

Your phone encrypts everything with keys tied to your passcode. See is my iPhone encrypted and is my Android phone encrypted. That protects a locked phone from a stranger. It does nothing against a partner, a parent or a friend who knows your passcode, because their key is your key. A vault’s value is a second key behind a second code.

How York Vault answers the five questions

1. A forgotten code. Your 12-word recovery key opens the library. We cannot reset a code, because we never hold it. An optional 72-hour reset through your Apple Account or Google account is off unless you turn it on.
2. Your old code. York Vault never stores it in readable form and cannot show it.
3. Names and thumbnails. Each file gets its own random 256-bit key and AES-256-GCM. File names, dates, places, thumbnails and the index are encrypted too.
4. Backup. Every item is encrypted on the phone before it goes to your iCloud or Google Drive.
5. Outside checks. We publish a white paper that matches the code, an outside audit of the encryption core, and the source of that core library. See the security page.

See end-to-end encryption and zero knowledge. Download York Vault.