A photo can disappear from a gallery without becoming private. The useful question is what happens to the file itself—and who has the key to open it.

Start with the file, not the lock screen

A lock screen controls access to an app. Encryption changes the stored content so that reading the file requires the correct key. A useful photo-vault review needs to look at both: how files are stored and how the app decides to unlock them.

What the name tells you

AES is a symmetric encryption algorithm: the secret key is needed to decrypt what it protects. In AES-256, 256 describes the key length. GCM is an authenticated-encryption mode, adding a check that can reject altered encrypted content. These definitions describe building blocks, not a certification of an entire app. NIST’s GCM recommendation explains authenticated encryption.

Your passcode is not the encryption key

Photo Vaulty creates a random 256-bit key for each vault. Your chosen password, passcode or swipe pattern protects access to that key together with a device-held secret. Media, previews and sensitive library information are encrypted. Choosing a longer pattern does not turn AES-256 into a bigger-key algorithm.

This distinction matters when comparing apps. Ask what protects a copied backup, whether keys synchronize, and whether the developer holds a recovery key. An impressive algorithm name does not answer those questions.

Protection has an edge

Encryption at rest does not hide an already unlocked screen from someone looking over your shoulder. It does not protect a plaintext export after you send it elsewhere. Importing into Photo Vaulty leaves the original in Apple Photos, where it has its own storage and backup lifecycle.

Three questions worth asking

  • Are originals, previews and sensitive metadata protected?
  • Who holds the keys, and what happens if they are lost?
  • What happens to originals, exports and backups outside the vault?

Photo Vaulty is still preparing for release. Its current implementation uses AES-256-GCM, but automated testing is not an independent security audit. Read the current security explanation before treating any app as your only copy of important memories.