Vaultaire vs Secret Photo Vault

Feature Comparison

Vaultaire: 17/17 features. Secret Photo Vault: 5/17 features.

Pricing Comparison

Passcode vs. Encryption Key

Secret Photo Vault asks you to set a passcode. That passcode gates access to the app's interface. It does not encrypt anything. The passcode is an access control mechanism, not a cryptographic primitive. The files behind it remain in their original format, stored in the app's sandbox directory. The distinction matters: an access control can be bypassed by accessing the data through a different path. An encryption key cannot be bypassed because without it, the data does not exist in readable form.

Vaultaire's pattern lock is part of the cryptographic access path, not only a UI gate. PBKDF2-HMAC-SHA512 combines the visual pattern with a device-wide salt to derive a 256-bit vault key. That key authenticates the encrypted index and unwraps a separate random master key used for AES-256-GCM file encryption. Without a valid unlock or recovery path, the data remains ciphertext.

File System Visibility

When a vault app stores files without encryption, those files are visible to any tool that can read the iOS file system. Connect the device to a Mac, open iTunes or Finder, and browse the app's document directory. The photos are right there -- JPEG, PNG, MOV files with their original content intact. A forensic examiner does not need to crack any passcode; they simply read the files from the backup or the device directly.

Vaultaire writes encrypted indexes, file headers, thumbnails, and content to its container. Each AES-256-GCM value includes a nonce and authentication tag. Browsing the file system does not reveal readable image headers, video content, or user metadata, but filenames, counts, ciphertext sizes, timestamps, and storage use can still reveal structure.

Data Loss Prevention

Secret Photo Vault provides no backup mechanism for hidden photos. Device loss, iOS update failures, or factory resets result in permanent data loss. This is a structural problem: without encryption, there is no safe way to back up the data to a cloud service, because the backup would expose the unencrypted photos to the cloud provider. The app is stuck in a paradox -- it cannot protect the data on disk, and it cannot safely back it up off-device.

Vaultaire reduces this risk by encrypting before backup. CloudKit receives ciphertext rather than readable photos, while Apple can still observe record counts, sizes, timing, and account metadata. A custom recovery phrase opens an encrypted recovery manifest. Restoration still requires the matching CloudKit records, so backup lowers device-loss risk without making recovery guaranteed.

Password Recovery Limitations

Forget your Secret Photo Vault passcode, and you face a binary outcome: either the app has a recovery mechanism (which means the developer can access your data, defeating the purpose), or it does not (which means your data is permanently lost). Most passcode-based apps choose the latter, leaving users with no recourse. This is not a design choice born from strong security -- it is a consequence of not having a proper key management system.

Vaultaire generates a custom nine-word recovery sentence at vault creation. It is not BIP-39 and does not encode a 256-bit vault key. PBKDF2-HMAC-SHA512 processes the normalized phrase for 800,000 iterations to derive a recovery key, which opens an AES-GCM encrypted key envelope. New-device restoration also requires the corresponding encrypted CloudKit backup records.