Velcrypt vs Private Photo Vault

Last checked: October 2026. Product details change; check each app's App Store listing for the current version.

Private Photo Vault has been one of the familiar names in iPhone photo vaults for years. Velcrypt is newer and takes a narrower, more opinionated approach. Both keep sensitive photos out of your camera roll; they differ in how you unlock them, how decoys work and how much they tell you about encryption.

Two approaches in brief

Private Photo Vault, from Legendary Software, is a PIN- or passcode-locked vault app. According to its App Store listing, it offers albums, a decoy password and break-in reports, with some features in a paid tier.

Velcrypt is a pattern-locked, on-device vault. A pattern is a continuous line drawn through at least six dots on a 5×5 grid, with at least one change of direction. Each distinct pattern derives its own encryption key and opens its own vault. There is no account, no cloud and no list of vaults anywhere in the app.

Feature comparison

	Velcrypt	Private Photo Vault
On-device encryption details published	Yes: AES-256-GCM, per-vault and per-file keys	Not stated publicly in detail
Account required	No	Not stated publicly
Cloud backup	No (v1); encrypted backup planned	Varies; check current listing
Unlock method	Pattern on a 5×5 grid	PIN / passcode
Biometrics (Face ID / Touch ID)	Not offered, by design	Varies
Decoy / multiple vaults	Every pattern is its own vault	Decoy password
Duress pattern	Coming soon (Premium)	Not stated publicly
Break-in reports	Not offered	Offered, according to its listing
Recovery if you forget the code	None	Not stated publicly
Business model	Free version plus optional Premium	Free version plus paid upgrade
Platforms	iPhone (iOS 17+)	Varies; check store listings

Unlocking and decoys

A PIN is familiar and fast. Its weakness is that people choose predictable numbers, and a four- or six-digit code has a small space to search if an app doesn’t slow guessing down. A pattern on a 5×5 grid has a larger space than the classic 3×3 phone pattern, but humans are predictable there too, which is why Velcrypt recommends 8–12 dots. You can test the idea on a look-alike pattern with the pattern strength checker.

Decoys work differently. Private Photo Vault’s decoy password, as described in its listing, is a second code that opens a separate, harmless set of photos.

In Velcrypt, decoys aren’t a special mode. You simply create another vault with another pattern and keep something unremarkable in it. Because any unseen pattern opens a fresh, empty vault without an error, someone looking over the app can’t tell how many vaults you have. The guide to decoy vaults explains why that matters.

Encryption and transparency

Velcrypt publishes its design so you can judge it yourself. Files are encrypted with AES-256-GCM through Apple CryptoKit. Keys come from your pattern via PBKDF2-HMAC-SHA512 with at least 600,000 iterations and a per-device random salt kept in the iOS Keychain. Each vault has its own random 256-bit master key, and per-file keys are derived with HKDF. iOS Data Protection adds a further layer. The security page also lists what Velcrypt does not protect against.

For Private Photo Vault, we could not find an equivalent public technical description at the time of writing. That doesn’t mean its protection is weak; it means you should look at the developer’s own documentation before deciding.

When Private Photo Vault may suit you better

• You want break-in reports. If knowing that someone tried to open your vault matters to you, Velcrypt does not offer this.
• You prefer a numeric code or Face ID. Some people find a PIN quicker than drawing a pattern.
• You want a backup or transfer option. If the version you use offers one, that is something Velcrypt v1 does not have.
• You’re already settled in. Moving a large library takes effort; switching only makes sense if the differences matter to you.

When Velcrypt may suit you better

• You want vaults that don’t reveal each other. No vault list, no error on unknown patterns.
• You want no account and no servers. See offline, no account.
• You want documented encryption. The algorithms and key handling are public.
• You want documents too. Velcrypt imports files from the Files app alongside photos and videos.

A note on originals

With any vault, importing usually creates a copy. The original stays in Photos and then in Recently Deleted for about 30 days after you delete it. Follow delete original photos after import so the vault is the only copy, and read are photo vault apps safe? for a wider checklist.