Privacy in practice
AES-256 photo vault encryption: what it protects, and what it cannot
Understand AES-256-GCM in an iPhone photo vault, why your passcode and backup still matter, and what encryption cannot do about originals or shared copies.
AES-256 encryption helps protect stored photo-vault files from being read without the keys. In Vault Max, AES-256-GCM also checks the encrypted content for tampering. That is a useful, specific promise. It does not mean a photo disappears from every other place you saved it, or that an open vault is safe to hand to someone else.
If you are choosing a private photo app, the algorithm is one question to ask. The better question is what happens to your pictures from import through viewing, sharing and recovery. Here is how those pieces fit together in Vault Max.
Start with the files, not the lock-screen artwork
A passcode screen can hide an interface. Encryption protects the stored content behind that interface. They solve different parts of the problem.
Vault Max stores photos, videos, documents, notes and its library index in encrypted files. Its internal file names are random identifiers rather than your original photo titles. The working library lives on your device; there is no Vault Max account containing a provider-hosted copy of it.
Sample Vault Max library. Select a screen for a closer look.
The same distinction applies to calculator disguise. A calculator can make the entry screen less conspicuous, but its appearance does not add extra bits to an encryption key.
What AES-256-GCM means in ordinary use
AES is the encryption algorithm. The 256 describes the key size. GCM adds an authentication check so the app can detect content that fails verification instead of treating altered ciphertext as a valid picture.
Apple's CryptoKit AES.GCM documentation describes encryption with an authentication tag and verification during decryption. Vault Max uses Apple's CryptoKit for those operations. Its media format processes files in authenticated chunks. Supported videos can play directly from those chunks; other playback formats may use a temporary decrypted copy.
Authentication here means checking encrypted data. It does not mean Face ID, an identity check, a security certification or an independent audit. An app naming a respected algorithm has told you something about its design; it has not proved every part of the product correct.
Your credential still matters
A 256-bit key and a six-digit PIN are different things. Vault Max creates cryptographic keys and uses a password-based derivation process, together with a device secret held in Keychain, to protect access to them. The PIN is not stretched into 256 bits of human-chosen unpredictability just because the app uses AES-256.
Choose a credential that another person cannot infer from your birthday, device code or a public demonstration. Vault Max supports PINs, passwords and patterns. Repeated wrong-code attempts trigger increasing delays, but a delay is no substitute for keeping your credential private.
Biometric unlock is a convenient access method when already configured. Keep your actual credential available independently too. If you forget it, the change-passcode screen still asks for the current code; opening the vault with biometrics does not turn that screen into a reset service.
Encryption does not remove your Photos originals
Importing a photo creates a vault copy. The original can remain in Photos, a message conversation, a Files folder or another device. The vault's encryption does not reach into those places and change them.
After import, open the result and inspect it before deciding what to do with the original. If you use iCloud Photos, understand how deleting from that library affects synced devices. Follow the import and original-copy walkthrough for the actual app steps.
Sharing works in the other direction. An image you deliberately export to Photos or send to another app becomes a copy outside the vault. The recipient's app and storage choices then matter. Describing that entire journey as “data never leaves the phone” would leave out the actions you explicitly choose.
An open session needs a clear end
While you browse, the app must make the selected content readable. Someone looking at an unlocked screen can see what is on it. Encryption at rest cannot prevent that ordinary physical observation.
Sample Vault Max library. Select a screen for a closer look.
Set background auto-lock and learn the manual and panic-lock routes. A screenshot shield is also a best-effort feature, not a promise against every capture method or another camera pointed at the display.
A recovery archive creates another security decision
Vault Max can export an encrypted .vaultmax backup with a separate password. You choose its destination through Files. A cloud-backed destination stores that archive with the selected provider; a local or external destination has different access and loss risks.
Sample Vault Max library. Select a screen for a closer look.
A backup password cannot be replaced by restoring an App Store purchase. If neither the working vault nor a usable archive is accessible, support has no server library from which to retrieve your pictures. Read the recovery checklist before the collection becomes irreplaceable.
- Keep it distinct from public examples and easy personal facts.
- Know where copies remain after an import.
- Check the lock screen before handing over the phone.
- Keep the archive and its password usable if the phone is unavailable.
Tap a box as you go. Checks reset when you leave this page.
AES-256-GCM is a solid part of Vault Max's storage design. The day-to-day result also depends on the credential you choose, the copies you keep and the way you close and recover the library. Those are useful questions to ask of any photo vault, including ours.
Continue reading
More guides
Practical tips for your private library. Swipe or scroll to choose your next guide.
50 guides to explore