Vault apps love the word "encrypted", and some add "military-grade". Neither tells you much. This guide explains, without math, what real encryption in a photo vault involves, so you can read an app's claims and know what they mean.
What's the difference between hiding and encrypting a photo?
Hiding puts a door in front of a normal photo. Encrypting turns the photo itself into unreadable data.
A vault that only hides stores your photos as ordinary image files inside the app, and shows a PIN screen before it displays them. Anyone who gets at those files another way (a computer backup, a forensic tool, a bug) sees the photos. An encrypting vault stores only scrambled data. Without the key, even a perfect copy of the files is useless.
What is an encryption key?
A key is a long random number that the encryption uses to scramble and unscramble data. A 256-bit key has about 1077 possible values, far beyond what any computer could try, so nobody guesses the key itself.
That's why attackers don't go after the key. They go after the thing that unlocks it: your code.
How does a PIN or pattern become a key?
Through a "key derivation function", which turns your code into a key. Good ones are deliberately slow and memory-hungry, so each guess costs real time.
This matters because codes are short. A 4-digit PIN has 10,000 possibilities. If each guess took a microsecond, a computer would try them all in a hundredth of a second. If each guess takes half a second and a lot of memory, the same search takes over an hour for a 4-digit PIN, and grows enormously with every extra character or bolt. A long random password becomes impractical to guess.
- Argon2id is the current recommended choice. It's "memory-hard", which makes it expensive to speed up with graphics cards or custom chips.
- PBKDF2 is older and still common. It's slow, but cheaper to attack with specialised hardware.
- A plain hash, or nothing, means guesses are nearly free.
Noxium, which we make, uses Argon2id with 64 MiB of memory and 3 passes, plus a random 256-bit salt so the same pattern never produces the same key twice.
What does AES-256-GCM mean?
It's the cipher that scrambles the photos, in a mode that also detects tampering.
- AES is the standard cipher used by governments, banks and your iPhone itself.
- 256 is the key size in bits.
- GCM adds an authentication tag: if a single bit of the encrypted file is changed or damaged, decryption fails instead of producing a corrupted photo.
"Military-grade encryption" usually just means AES. The interesting questions are what the key comes from, where it's kept, and whether the backup is encrypted too.
Why do good vaults use "keys inside keys"?
So you can change your code without re-encrypting every photo, and so one leaked file key doesn't expose the rest.
- Your code is stretched into a wrapping key.
- The wrapping key unlocks a random vault key, stored only in encrypted form.
- The vault key unlocks a separate random file key for every photo, video and note.
Changing your code only re-wraps the vault key. A recovery phrase works the same way: it's a second wrapping of the same vault key, so either the code or the phrase opens the vault. Large videos are often encrypted in chunks, so they can play without decrypting the whole file first. Noxium uses 1 MiB chunks, each with its own authentication tag. The full key hierarchy is on our security section.
How does an encrypted backup stay private?
By encrypting on the phone before anything is uploaded, so the cloud only ever stores scrambled data. This is called end-to-end encryption.
The test is simple: could the company reset your code by email and give you your photos back? If yes, they can reach the key, and so could anyone who gets into their systems or your email. If no, only you can decrypt the backup, which is also why losing both your code and your recovery phrase means losing access.
Noxium encrypts photos, thumbnails and their names, dates and places on the iPhone, then backs up only that ciphertext to your own private iCloud (CloudKit). Apple stores it but can't read it.
What can encryption not protect against?
- Someone watching you enter your code, or making you enter it.
- An open vault. While it's unlocked on screen, the photos are visible. Good apps lock quickly and hide content in the app switcher.
- A short code. Slow key derivation helps, but a 4-digit PIN can still be tried exhaustively.
- Copies outside the vault, such as originals left in Photos, Messages or Recently Deleted.
How can you tell if a vault really encrypts?
- It names the cipher and the key derivation (for example AES-256-GCM and Argon2id or PBKDF2), not just "secure".
- It says encryption happens on the device, before backup.
- It can't reset your code by email, or it says honestly that it can.
- Its backup is described as encrypted with your key, not just "secure cloud".
- Ideally, the encryption code is open source or independently reviewed.
In October 2026, only 2 of the 17 vault apps we compared named AES-256-GCM in their App Store description. See them all in our comparison.
Encryption you can read about
Noxium names every piece: Argon2id for your pattern, AES-256-GCM for each file, and only ciphertext in your own iCloud. Free for 150 photos and 10 videos.
Join the beta Version 1.0 was submitted to App Store review in October 2026. It is not on the App Store yet.Questions people ask
Are photo vault apps encrypted?
Some are, some aren't. Many only show a PIN screen in front of ordinary files. Look for a named cipher, such as AES-256, and encryption on the device before backup.
What does military-grade encryption mean?
Usually just AES, the standard cipher. It doesn't tell you how the key is made or stored, which matters more.
What is Argon2id?
A key derivation function that turns a password or pattern into an encryption key slowly and with a lot of memory, so guessing codes is expensive.
Can an encrypted vault be hacked?
The encryption itself isn't the weak point. Short codes, codes seen by someone else, and unencrypted copies left elsewhere are. Use a long code and remove originals after importing.
Something wrong or out of date? Email business@inertiaprojects.info and we'll fix it.