Hidden isn’t encrypted: how to check what your photo vault does

A vault app that hides your photos is not necessarily protecting them. On Android, there are cheap ways to make a photo vanish from the gallery that do nothing to stop someone from opening it. Here is how to tell the difference.

Three ways apps "hide" a photo

1. Hiding the folder. Android's media scanner skips any folder that contains a file named .nomedia, and many file browsers hide folders whose names start with a dot. Move a photo into such a folder and it disappears from your gallery, but the file itself is untouched. Any file manager that shows hidden files can open it.

2. Renaming the file. Some apps change a photo's file extension to something unfamiliar, so galleries stop recognising it. Rename it back and it opens normally.

3. Encrypting the file. The photo is transformed with a secret key, so the stored file is unreadable without it. Even with full access to the phone's storage, you only get noise.

Only the third one protects the photo if someone gets at your files. The first two only protect it from your gallery.

How to check your vault

You don't need to be technical to get a good idea of what your vault does.

1. Look at its folder. Open a file manager, turn on "show hidden files" and look for the vault's folder. If you find files with recognisable photo names, or they open when you tap them, they aren't encrypted.
2. Copy a file to a computer. Try to open a file from the vault folder on a computer. An encrypted file won't open in any image viewer.
3. Read the documentation. A vault that encrypts usually says how: which algorithm, where keys are kept, and what happens when you forget your PIN. Vague phrases with no details are a reason to ask more questions.

Five questions to ask any vault app

1. Which encryption, and where does it happen? Encrypting on your phone, before anything is uploaded, keeps the most in your control.
2. What protects the key? A short PIN on its own is weak. Look for key stretching and hardware-backed storage such as Android's keystore.
3. Where do backups go? Your own cloud storage, the vault company's servers, or nowhere at all?
4. How does recovery work? If you can reset your PIN through an email address or an online account, anyone with access to that account might be able to as well. If there is no reset at all, a forgotten PIN means lost files. Every option is a trade-off, and a good app tells you which one it made.
5. Are the originals really deleted? Hiding should remove the original from your gallery and folders, not leave a copy behind.

How Hidey answers them

We built Hidey so it can answer all five plainly:

• Files are encrypted on your phone with AES-256-GCM before they are stored or backed up.
• The vault key is protected by your PIN or password, stretched with Argon2id and combined with a hardware-backed Android keystore key.
• Backups go to a hidden folder in your own Google Drive, or your own S3 storage with Pro.
• PIN reset goes through Google with a 24-hour wait, or through a recovery key only you hold in zero-knowledge mode.
• Originals are deleted only after the encrypted copy has been checked.

The details, including the trade-offs, are on our security page.