Is a calculator vault app safe? A checklist for any vault app

From the home screen, every calculator vault looks the same. Underneath, some encrypt each photo with a key only your code can unlock; others move your files into a hidden folder and draw a calculator on top. The word “encrypted” on a store listing can cover either.

This guide skips the explainer (the Calculator Locker home page covers what a calculator vault app is) and sticks to evidence: what researchers found when they took vault apps apart, a ten-minute checklist you can run on any vault app, and that checklist run on ours.

What researchers found, 2015 to 2025

Each study tested the app versions of its time, so read this as history, not a verdict on any app today. It shows the mistakes vault apps have made again and again, which is what the checklist below is built to catch.

• April 2015: NQ Vault. A researcher showed that NQ Vault, then past 10 million Play downloads, “encrypted” files with a one-byte XOR key, and only their first 128 bytes (The Register).
• November 2015: three iPhone vaults. IOActive took apart Private Photo Vault, KeepSafe and My Media on a jailbroken iPhone running iOS 7, and reported unencrypted photos, lock screens that were easy to bypass, and passwords kept or sent in plain text (IOActive). All three apps have been updated many times since.
• 2017: 18 Android vault apps. Zhang, Baggili and Breitinger tested apps with about 220 million downloads between them. Six didn’t encrypt photos, eight didn’t encrypt videos, seven stored the password in clear text, and ten gave up their data without the phone being rooted (Computers & Security).
• 2022: 20 Android vault apps. Ruffin, Lopez-Toledo, Levchenko and Wang found that only 5 of 20 popular vault apps attempted to encrypt files; others hid them or changed the extension or header. Seven exposed PINs or recovery emails in plain text, and only 7 disguises worked as the thing they pretended to be (WPES 2022 paper).
• March 2025: Gallery Vault. Security firm S-RM found that Gallery Vault 4.4.26 for Android stored the PIN as SHA-1 and MD5 hashes, quick to reverse for a short PIN, and that settings and files could be decrypted with keys hardcoded into the app (S-RM).
• April 2025: a cloud leak. Cybernews reported that Photo Vault, an iPhone app from Brain Craft with about 72,000 downloads (not the similarly named Private Photo Vault), had left its Firebase database open without a password, exposing email addresses, plain-text passwords, notes and metadata for about 17,000 albums. It was secured after disclosure (Cybernews).

Three failures repeat across a decade: files that were never really encrypted, codes that could be read or guessed in seconds, and servers that leaked. An old study can’t tell you whether an app has since fixed them; testing the app in front of you can.

A 10-minute checklist for any vault app

No root access, computer or security background needed. Use one throwaway photo, never a real one. Menus are for Android 15 and later, with iPhone notes where it differs.

1. Read the labels under the app name. On Google Play, look for “Contains ads” and “In-app purchases” below the title. Developers must declare ads, including ones served by third-party ad SDKs (Play Console Help). It doesn’t mean the vault is broken, but an ad network’s code runs inside the app that holds your most private photos. On the App Store, scroll to App Privacy: a “Data Used to Track You” box means data from the app may be linked with other companies’ data for advertising (Apple’s definition).
2. Open the Data safety section. On the Play listing, tap Data safety, then See details (Google’s explainer). If “Photos and videos” appears under data collected, your files leave the phone, usually for a cloud backup. The developer writes this section, so it’s a claim, not an audit; a vault that claims to collect nothing yet wants an account has some explaining to do.
3. Find out how a forgotten code is reset. The most telling test: search the app’s FAQ or help pages for “forgot”. If the company can reset your code by email, sells a paid “password reset”, or publishes a universal code such as 11223344, then something other than your code can open the vault, and your code isn’t really what protects the files. A properly encrypted vault can only offer recovery you set up yourself in advance, or none at all. More in what to do if you forgot your vault code.
4. Run the airplane-mode test. Turn on airplane mode, close the app fully, then open the vault, add the test photo and view it. A local vault works normally. If it won’t open, asks you to sign in or just spins, your files or your login depend on a server, and that server’s security is now part of yours. Turn airplane mode off and watch for a sudden “syncing” message.
5. Run the screenshot test. Open the test photo in the vault and take a screenshot. Android lets apps block screenshots and screen recording with a system flag (FLAG_SECURE), so a careful vault gives you a black image or a “can’t take screenshot” message. In the recent-apps screen, its preview should be blank or blurred. On iPhone, no app can block screenshots because iOS offers no way to (Apple developer forums); the most a vault can do is blur its app-switcher preview.
6. Run the export test. Get the test photo back out to your gallery or a file, and look for a full backup or export option. A vault with no way out holds your photos hostage. When the iPhone app Calculator+ stopped opening after iOS 14.2 in 2020, users in a long Apple Community thread had to dig their photos out of old computer backups.
7. Ask what happens on uninstall and on a new phone. On Android, uninstalling an app deletes its private storage (Android developer docs), so a vault kept there goes with the app, and phone-to-phone transfers often skip it. Files kept in shared storage may survive, but other apps can reach them; NQ Vault’s own FAQ warns that cleaner apps can delete its folder. The answer you want: there’s an export, and you’ve tested it. See what deleting a vault app does to your photos.
8. Check the permissions. Settings › Apps › the app › Permissions. Camera (for intruder photos) and photo access (to import) make sense, and so might location for break-in alerts. Contacts, call logs, SMS or device admin access each deserve a clear reason.
9. Check the size and the name. Settings › Apps › the app › Storage. In the 2022 study a real calculator took 6.10 MB, while the smallest calculator-disguised vault took about 35 MB before any files were added, and a vault grows with every photo. Compare the name in the app list with the label on the home screen too: in the same study, 17 of 20 vault apps didn’t match. Neither is an encryption flaw, but both give a disguise away.
10. Check that someone still maintains it. Look for a recent “Updated on” date on the Play listing (Version History on the App Store), a working support email and a privacy policy. Abandoned vaults are the ones that stop opening after a system update.

If an app fails and you just want photos out of sight, Android’s built-in options may be enough. Compare Locked Folder, Secure Folder and Private Space, or see our list of free photo vault apps without ads.

What good encryption looks like

“Military-grade encryption” on a listing tells you nothing; NQ Vault’s XOR trick was sold as encryption too. Here’s what doing it properly means.

Every file is actually encrypted

The photo on disk should be unreadable without the key: not renamed, not given a fake extension, not a scrambled header on an intact file. Thumbnails and file names too, since they leak plenty on their own. Look for a specific claim, such as AES-256 on the device with the key derived from your code, rather than an adjective.

A slow key derivation

Your code isn’t the key; the app turns it into one. Do that with a single fast hash and a computer can try all 10,000 four-digit codes in a fraction of a second. A deliberately slow function such as PBKDF2, scrypt or Argon2 makes each guess cost real time. OWASP lists weak key derivation as a known mobile weakness (MASWE-0014), and a 2020 forensics write-up found vault apps often using plain SHA-256.

A key tied to the phone’s secure hardware

Slowness alone can’t save a four-digit code: at one guess per second, all 10,000 take under three hours. The fix Apple uses for the iPhone passcode itself is to mix the code with a secret held in secure hardware that can’t be copied out (Apple Platform Security). Every guess then has to happen on that phone, at its pace, and a vault file copied to a computer is useless. Android’s equivalent is the hardware-backed Keystore, or StrongBox where the phone has one.

No back door, not even a friendly one

No keys hardcoded into the app, no copy of your key on a server, no reset code: if the developer can open your vault, so can anyone who breaks into the developer. If the app offers cloud backup, files should be encrypted on the phone before upload, with a key the company never sees. If the listing doesn’t say, ask.

What no vault app protects against

When researchers interviewed adults who keep private photos hidden on their phones, most wanted protection from shoulder-surfing and accidental exposure on shared devices, not from skilled attackers (SOUPS 2024). A good vault handles that. It can’t handle these.

• Someone watching you type the code. A four-digit code tapped into a calculator is easy to memorise from across a sofa. Use fingerprint unlock if offered, and change a code you think was seen.
• A compromised phone. Encryption protects stored files, not what’s on the screen. Spyware or stalkerware that records the screen or keystrokes sees what you see, as does anyone you hand the phone to with the vault open.
• Legal compulsion. Forensic tools recognise many vault apps by package name, whatever icon they wear (Duncan and Karabiyik, 2018), and whether you can be made to hand over a code depends on where you live.
• Losing the phone without a backup. Strong local encryption cuts both ways: if nobody else can get in, neither can you once the phone is gone. Keep an encrypted export somewhere else, and read how to transfer hidden photos to a new phone before you wipe an old one.

Calculator Locker, run through the same checklist

Here is the checklist run on our own app: the Android version on Google Play, checked on 30 October 2026. The right-hand column is the part most vendors leave out.

The short version: no ads, no account, no server, and a code that can only be guessed on your own phone. The cost is that the vault depends on you, so export it before you change phones and keep the export’s passphrase somewhere other than the phone. The full list is in Calculator Locker’s security details.