Choosing an app to hide photos: 5 approaches compared

Search the App Store or Google Play for an “app to hide photos” and you will see hundreds of apps that look nearly identical in screenshots: a keypad, a padlock icon and a grid of albums. Underneath the user interface, however, those apps do five completely different things with your files.

Some merely move unencrypted JPEGs into a sub-⁠folder and put a four-⁠digit PIN screen in front of them. Others upload your private photos to a company cloud server tied to your email address. Only a small group encrypts each photo on your phone with a key derived from your own secret.

The 5 types of photo-⁠hiding apps, compared

Before installing anything, match the app category to what you are actually trying to protect against.

Approach 1: Built-⁠in OS hiding (Apple Hidden album and Google Locked Folder)

Before paying for any third-⁠party app, check whether your phone’s built-⁠in option already solves your problem:

• On iPhone: Apple’s Hidden album removes photos from your main Library grid, Memories and Home Screen widgets, and locks the Hidden view behind Face ID, Touch ID or your iPhone passcode. You can also hide the Hidden row itself under Settings > Apps > Photos > Show Hidden Album.
• On Android: Google Photos Locked Folder moves selected items out of the main photo grid and opens with your device screen lock.
• On iOS 18 and later: you can also require Face ID to open the entire Photos app from the Home Screen.

Where built-⁠in hiding stops: every built-⁠in option shares your phone’s screen-⁠lock passcode. If a partner, roommate, family member or thief knows your 6-⁠digit phone passcode, they can unlock Hidden, unlock Locked Folder, and unlock Face ID-⁠locked apps (at familiar locations even when Stolen Device Protection is on). In addition, apps granted Full Access to Apple Photos can request hidden assets via PHFetchOptions.includeHiddenAssets.

Approach 2 & 3: Plain folder hiders and calculator disguise apps

Many older vault apps and “secret calculator” apps were built before modern mobile cryptography libraries were common. When you import a photo, the app copies IMG_4021.JPG into its internal Documents/ or files/ directory and puts a PIN keypad or calculator screen in front of the gallery view.

That creates two problems:

1. Unencrypted bytes at rest: if the app does not exclude its folder from unencrypted computer backups, or if an Android app places files in shared media folders with a .nomedia marker, anyone inspecting the backup or folder sees the raw JPEG files without ever typing the PIN.
2. Ad-⁠network and analytics SDKs: many free folder hiders monetise through banner and interstitial ad SDKs that run inside the same app process as your private photos.

A calculator disguise or alternate app icon is genuinely useful when someone looks over your shoulder at your Home Screen, as long as it sits on top of real per-⁠file encryption rather than replacing it. See our dedicated guide on how calculator vault apps work.

Approach 4 & 5: Cloud account vaults versus on-⁠device encrypted vaults

Among serious vault apps, the real architectural choice is cloud-⁠account vault versus local zero-⁠knowledge encrypted vault:

• Cloud-⁠account vaults ask you to register with an email address or phone number and upload your photos to their cloud storage. The upside is convenience: if you lose your phone or forget your PIN, customer support can send a reset link to your email. The trade-⁠off is that your identity is tied to a photo-⁠vault account, and unless the app implements true client-⁠side zero-⁠knowledge encryption, the provider’s servers hold the keys to decrypt your files.
• On-⁠device encrypted vaults never ask for an email address, never create a cloud account, and never upload your photos to a company server. Your pattern or PIN is stretched with PBKDF2-HMAC-SHA512 (600,000 rounds) and combined with a key held in your phone’s Secure Enclave (iPhone) or StrongBox/TEE (Android), so it can only be tried on your phone. Files are encrypted in 1 MB pieces with AES-⁠256-⁠GCM; each file gets its own key, and every piece is checked so a changed or reordered piece is refused.

If you want to compare specific apps head-⁠to-⁠head with cited sources, read our best photo vault apps guide and our deep dive into whether photo vault apps are safe.

How to move photos out of your camera roll without leaving copies

Whichever vault app you choose, importing a photo does not make the original disappear on its own. Follow all four steps so copies do not linger in your camera roll or cloud trash:

1. Audit your existing app permissions in Settings under Privacy and Security, then Photos, and switch apps from Full Access to Limited Access or None.
2. Import the photos and videos you want to protect into your encrypted vault app and verify that they open cleanly inside the vault.
3. Confirm the prompt to delete the originals from Apple Photos or Google Photos, or delete them manually from the main library and Hidden album.
4. Open Utilities, then Recently Deleted in Photos (or Trash in Google Photos) and permanently delete the removed items so they do not sit recoverable for 30 days.

Finally, choose a vault lock that cannot be guessed in three tries. You can test how many combinations a pattern, PIN or passphrase actually has with our unlock strength calculator.