Forgot your photo vault password or pattern? What you can and can’t do

That sinking feeling when the shape you have drawn a hundred times suddenly doesn’t work is real. Before anything else: don’t delete or reinstall the app. Most “forgotten” patterns turn out to be slightly misremembered ones, and there are sensible things to try first.

First, try this (in Velcrypt)

Velcrypt behaves differently from most apps when you get the pattern wrong. It doesn’t show an error. Any pattern it hasn’t seen before simply opens a new, empty vault. So if your vault looks empty, the most likely explanation is that you drew a slightly different pattern, not that your data disappeared.

Work through these calmly:

1. Don’t add anything to the empty vault. If you import items into it, you create a new vault under that mistaken pattern, which adds confusion later.
2. Close the app and start again. Velcrypt locks when it goes to the background (after the delay you have set), which gives you a fresh unlock screen.
3. Check the starting dot. A pattern is a sequence of dots, so starting from the other end of the same shape is generally a different pattern.
4. Check for skipped or extra dots. On a 5×5 grid, a straight line can easily pass through one more or one fewer dot than you intended.
5. Think about where you usually are. Muscle memory is tied to posture. Try drawing in the position you usually unlock in: one-handed, two-handed, sitting down.
6. Sketch it on paper. Draw the 5×5 grid and sketch the pattern from memory, then compare variants. Destroy the paper afterwards.
7. Take a break. Memory recall under stress is worse. Trying again later, rested, often works.

If it really is gone

If none of that works, here is the honest answer: the content can’t be recovered. Not by you, not by Velcrypt, not by anyone.

That isn’t a policy choice that could be overridden. It is how the encryption works:

• Velcrypt has no account, no email and no server. See offline, no account.
• Your vault keys are unlocked by a key derived from your pattern on the device, using PBKDF2 and a salt stored in the iOS Keychain. Without the pattern, that key can’t be produced.
• The vault’s data is encrypted with AES-256-GCM, which can’t be brute-forced. The AES-256 explainer explains why.
• In the first version, vault data is excluded from iCloud and Finder/iTunes backups, so there is no older copy to restore from.

The same properties that make your vault private make a forgotten pattern final. A system with a “forgot pattern?” button necessarily keeps a way in that doesn’t depend on you alone.

What about other vaults?

Because every pattern is its own vault, forgetting one pattern doesn’t affect the others. If you remember your decoy vault’s pattern, that vault opens normally.

Why “no reset” is a deliberate trade-off

Recovery mechanisms always create a second key. Email resets can be triggered by anyone with access to your inbox. Cloud backups can be restored by anyone who gets into the account. Security questions are often guessable from social media.

Velcrypt chose to have no second key. That rules out an entire category of attacks and means there is nothing to subpoena, leak or phish. The cost is that you carry sole responsibility for remembering the pattern. For many people that trade-off is worth it; for some content, it isn’t. Decide which kind of content you are storing.

Preventing a lockout

Choose a pattern that is strong but memorable

Strength and memorability are not opposites. A good pattern on the 5×5 grid:

• uses 8–12 dots and changes direction several times,
• doesn’t start in a corner or trace a letter,
• has some personal logic that only you know, like a shape tied to a place or a gesture you find natural.

Test a similar shape (not your real one) with the pattern strength checker, and read pattern vs PIN vs Face ID for what makes patterns weak.

Practise it

• Open the vault regularly in the first weeks so the movement becomes muscle memory.
• Avoid changing your pattern right before a stressful period like travel.
• If you have several vaults, make their patterns clearly different so you don’t blend them.

Keep originals where loss would hurt

If losing a photo or document would be truly unbearable, a vault should not be the only place it lives. For irreplaceable items, keep an additional copy somewhere you trust, such as an encrypted drive in a safe place. This is a conscious trade-off: every extra copy is one more place to protect.

Don’t write the pattern down near the phone

If you must keep a written reminder, make it something only you can interpret and keep it far from the device.

If you use a different vault app

Recovery varies a lot between apps. Before you need it, check:

• Is there an account? Apps that use an email login often allow a PIN reset through that email.
• Is there cloud backup? Some apps can restore content after reinstalling if it was synced to their servers.
• Is there a recovery code? Some apps generate one during setup. If you didn’t save it, it won’t help.
• What does the help page say? Look for the vendor’s official recovery instructions. Be wary of third-party “unlock” tools; they rarely work and can be scams.

The guide to photo vaults without an account explains the trade-offs between account-based and device-only apps.

Where Velcrypt fits

Velcrypt is a device-only vault by design: no account, no server, no recovery phrase, no copy of your keys anywhere else. An encrypted backup and recovery option is planned as part of an optional Premium upgrade, without a promised date. If you are unsure, support can explain how the app behaves, but nobody there can open a vault for you.