The disguise is the selling point: an app that looks like a calculator until you type the secret code. But a disguise only works until someone sees through it, and then everything depends on what's underneath.
Red flags
- "Hidden," not "encrypted." If the listing never mentions encryption, assume files are just stored in a private folder.
- Email or phone recovery. If the developer can reset your code, the developer can get in.
- Full-screen ads. Ad networks run third-party code inside the app and often collect device identifiers.
- Huge permission requests. A vault doesn't need your contacts or your location.
- A brand-new developer with copied screenshots. Clones of popular vault apps appear and disappear regularly.
Green flags
- A named encryption scheme (AES-256-GCM, ChaCha20-Poly1305) and a named key derivation function.
- A clear statement that the developer can't recover your files.
- No account required, no ads in the vault itself.
- A privacy label on the App Store that says "Data Not Collected," or close to it.
A quick test you can run
Install the app, add a test photo, then delete and reinstall the app without restoring a backup. If your photo comes back without you entering any secret, it was stored somewhere with a way back in.
A better disguise
If you like the idea, look for an app that offers a disguised icon on top of real encryption, rather than a fake calculator on top of nothing.
Try Veilbox free
Encrypted on your iPhone. No account required.