What is a vault app? How photo vaults work on Android

A vault app is an app that keeps the photos, videos and files you choose behind a lock of its own, away from your gallery and every other app on your phone. Some hold only photos, some hold any file, and some disguise themselves as a calculator. Here is how vault apps work on Android, what their extra features really do, and what to check before you trust one with anything.

What a vault app does

A vault app takes a photo out of the places your phone normally shows it, such as your gallery, Google Photos and the photo picker other apps use, and keeps it where only the vault can open it. A good one does four things:

Moves the file out. The photo leaves your gallery and camera folder, so other apps can't see it.
Locks it. Opening the vault takes a PIN, password or fingerprint of its own, not just an unlocked phone.
Encrypts it. The file is scrambled with a key, so a copy taken off the phone is unreadable.
Backs it up. A lost or reset phone doesn't take your photos with it.

Every vault app does the first two. The last two are where vaults differ, and they matter most.

How a photo vault works on Android

When you hide a photo, a vault usually works through four steps:

Copy. It reads the photo and writes a copy into its own storage.
Encrypt. A vault that encrypts does it as it copies, with a key that your PIN unlocks.
Check. A careful vault makes sure the copy is complete before it touches the original.
Delete the original. The photo disappears from your gallery. On Android 11 and later, deleting photos that another app took needs your OK for each batch or a special permission such as All files access, which is why most vault apps ask for it.

To show you a hidden photo, the vault decrypts it inside the app. Unhiding runs the other way: the vault writes a normal copy back to a folder, often the one the photo came from, and deletes its own.

Where the hidden files live

Vaults keep your files in one of three places, and that decides a lot:

The app's private storage. Other apps can't reach it, but uninstalling the vault deletes it.
A hidden folder on your phone's storage. Usually a folder whose name starts with a dot, with a .nomedia file in it so galleries skip it. It survives an uninstall, but any file manager can find it, so the files inside need to be encrypted.
The vault maker's servers. Handy across phones, but your photos sit on someone else's computer, protected however they choose.

Our guide to what happens when you uninstall a vault app goes through each case.

Hiding isn't the same as encrypting

Some vault apps never encrypt anything. They move your photos into a hidden folder, or rename them so the gallery doesn't recognise them, and put a lock screen in front. That keeps photos out of the gallery, but anyone who copies the folder to a computer gets the photos, and our guide to finding hidden photos shows how quickly such folders turn up.

An encrypting vault turns each file into unreadable data that only its key can open. That difference is what counts when a phone is lost, sold or taken. Here's how to check what your vault does.

The extra features, and what they really do

Most vault apps add some of these. They're useful, but none of them replaces encryption.

Disguise. The vault appears as a calculator, clock or other everyday app. It fools a glance at your home screen, but Android's Settings, Google Play and the storage screen still list it. See what a calculator disguise can and can't hide and how app disguises work.
Decoy PIN. A second PIN opens a second vault with harmless content, for when someone makes you open the app. It only works if nothing in the decoy gives away the real vault.
Intruder photo. The vault takes a front-camera photo of anyone who types a wrong PIN. In a vault app, that usually means wrong PINs in the vault, not on your phone's lock screen (how intruder selfies work).
Private camera. Photos you take go straight into the vault and never reach your gallery or cloud backup (how private cameras work).
Recycle bin. Deleted items wait a while before they're gone, in case you deleted the wrong thing.

Backups and forgotten PINs

These are the two things people only think about once it's too late.

A vault's backup should be encrypted before it leaves your phone and go somewhere you control. Ask where it's stored, and whether you can restore it on a new phone without the old one.

Then ask what happens if you forget your PIN. Vaults recover in different ways: a reset by email, a reset through your Google account, a recovery key, or no recovery at all. Each one trades getting you back in against keeping everyone else out, as our guide to a forgotten vault PIN explains.

How to choose a vault app

Before you move anything private into a vault, check that it:

Encrypts on your phone, rather than just hiding or renaming files.
Deletes the originals after checking its copy, so nothing stays in your gallery.
Has its own lock, separate from your phone's screen lock.
Backs up somewhere you control, encrypted, and restores on a new phone.
Says plainly what happens if you forget your PIN, before you need to know.
Asks only for permissions that fit the job. Storage access to move files, and the camera if it has one. A vault has no need for your contacts, location or messages.

Vault apps vs your phone's built-in options

Many phones now come with something vault-like: Google Photos' Locked Folder, Samsung's Secure Folder, Xiaomi's Private album, Private Safe on OPPO, realme and OnePlus phones, and File Safe on vivo. They're free and need no install, but each one only works on its own maker's phones, and some open with your screen lock. A vault app works the same on any Android phone, with a lock of its own. See every option compared, or Locked Folder vs a vault app if you use Google Photos.

A note for parents

If you've found a vault app on your child's phone, or suspect there's one, a few things are worth knowing:

Vault apps are common, and most people use them for ordinary privacy: IDs, documents, screenshots and photos they'd rather not show everyone.
A disguised app still appears in Settings → Apps, which lists every installed app, disguised or not.
Google Family Link can require your approval before a child installs apps from Google Play.
A conversation usually achieves more than searching the phone. A well-made vault can't be forced open, and the "unlock" tools that claim otherwise are best avoided.

How Hidey works

Hidey is a vault app for Android, made for adults. It encrypts each photo, video or file on your phone with AES-256-GCM, checks the encrypted copy, then deletes the original from your gallery. The vault opens with its own PIN, password or fingerprint, and its files sit in a hidden folder under meaningless names, so a file manager finds nothing it can open.

Backups go to a hidden folder in your own Google Drive, encrypted before upload, and you can export a password-protected backup file too. If you forget your PIN, you can reset it through Google after a 24-hour wait. The catch: whoever controls your Google account could do the same, unless you turn on zero-knowledge mode (Pro) and keep a recovery key instead.

The calculator disguise is free. Pro adds hidden vaults, each with its own PIN, and if someone ever makes you open Hidey, give them a hidden vault's PIN rather than your main one: your main vault lists its hidden vaults, but nothing inside a hidden vault shows that any other vault exists. The security page explains how every part works.