On-device AES encryption
How TuckVault encrypts vault photos, videos and documents with AES on your phone, what that protects against, and what it does not — stated plainly.
At a glance
- AES encryption applied by the app as each file enters the vault
- Vault files are stored only in encrypted form, inside the app's protected storage
- Encryption happens on the phone; the vault is not uploaded to our servers
- Works together with the OS's own device encryption, not instead of it
- No cloud backup of the vault, no decoy vault, no break-in alerts, no disguised icon (yet)
- No published third-party audit yet — read the guide on how to judge any vault app, and hold us to it
“Hidden” is a visibility setting. “Encrypted” is a change to the file itself. Most apps that call themselves vaults do the first and let you assume the second — they put a PIN screen in front of ordinary image files in a renamed folder, and a file browser or a cable to a computer walks straight past the PIN.
TuckVault does the second. Here is what that means, in plain language, and where its limits are.
What happens when you add a file
- You pick a photo, video or document and import it.
- The app encrypts the file with AES — the standard symmetric cipher used by banks, operating systems and messaging apps — and writes only the encrypted result into the app’s protected storage.
- The file no longer exists as a readable image or document anywhere on the phone, once you have deleted the original from your library and its bin.
- When you unlock the vault with your PIN or pattern, the app decrypts files for viewing inside the vault. Lock it, and they are unreadable again.
Nothing in this process involves our servers. The vault lives on your phone.
What this protects against
| Situation | Hidden album / PIN-only “vault” | TuckVault |
|---|---|---|
| Someone scrolls your camera roll | Protected | Protected — files are not in the library |
| Someone with your phone passcode opens the app | Hidden Album: exposed. PIN-only: depends on the PIN | Needs the vault PIN or pattern |
| Phone connected to a computer, files browsed | Plain image files are listed | Encrypted files, not viewable as images |
| Photo library syncs to iCloud / Google Photos | Hidden photos sync | Vault files are not in the library; nothing syncs |
| Phone is unlocked with the vault open, in someone else’s hands | Exposed | Exposed — no app can fix this |
What we claim, and what we don’t
We think the honest version of a security page is the useful one.
We claim:
- Vault files are encrypted with AES by the app, on the device, and stored only in encrypted form.
- The vault opens only with the PIN or pattern you set, which is separate from your phone’s passcode.
- The vault is not uploaded to TuckVault servers.
We don’t claim:
- That the vault is unbreakable, or that it protects a phone that is already unlocked with the vault open.
- Zero-knowledge, duress or plausible-deniability features. There is no decoy vault, no break-in alert, no icon disguise, and no cloud backup of the vault at the moment.
- A published independent audit. Until there is one, judge us the way you should judge any vault app: by what the privacy label says, what the files look like from a computer, and whether the lock is separate from the phone’s. Our guide Are photo vault apps safe? walks through exactly that.
Encryption is half the job
The other half is habits. Encryption cannot help a photo that is still sitting in Recently Deleted, a PIN that matches your phone passcode, or a vault left open on the table. The two-minute routine — import, delete the original, empty the bin, lock — is what turns an encrypted vault into a private one. Start with how to move photos into a vault and delete the originals.
Lock what's private. Clear what isn't.
TuckVault keeps your private photos, videos and documents behind a PIN or pattern with AES encryption on your device — and cleans up duplicates, large videos and messy contacts on the same phone. Free to download for iPhone and Android.
Frequently asked questions
What does "encrypted on device" actually mean?
When you add a file to the vault, the app transforms it into unreadable data using AES encryption before writing it to storage, and keeps it that way. Opening the vault with your PIN or pattern lets the app decrypt files for viewing. The encrypted files are not plain JPEGs, MP4s or PDFs that another app, a file browser or a computer could simply open.
Is this different from the encryption my phone already has?
Yes, and both apply. iOS and Android encrypt the whole device, but that protection ends the moment the phone is unlocked — every app and every cable connection then sees ordinary files. TuckVault's encryption is a second layer that stays in place after the phone is unlocked, tied to the vault's own lock.
Can TuckVault or anyone else read my vault?
Vault files stay on your phone in encrypted form; there is no TuckVault cloud that receives them. The app, the operating system and an unlocked device are always part of the trust model for any app — including this one — which is why we say what the vault does and does not protect against rather than promising the impossible.
Does encryption slow things down?
Photos import almost instantly. Long videos take longer because every byte is encrypted; the progress bar shows where each import is. Viewing inside the vault is smooth on any phone from the last several years.