Android guide

Recovering photos from a photo vault app

Updated 2026-11-11 · 4 min read

Every week, people search "how do I get my photos out of [vault app]" after forgetting a PIN. The honest answer splits into two cases, and they have nothing to do with how good the app is.

Case A: the app moved the files somewhere and put a lock in front of the UI. Recoverable, usually easily. Case B: the app encrypted the files. Not recoverable without the key — by design, including by the developer.

Which case you're in determines everything below.

First: figure out which kind of app you used

A few two-minute tests:

1. Did it ever work offline? Both kinds can. Not conclusive.
2. Does it have a "forgot password" that restores access? If yes, it either keeps your key (or a copy of your files) on a server, or it wasn't encrypting. Real encryption can't do password reset without the key.
3. Can you see the files with a file manager? Open your file manager and look for the app's folder (usually /Android/data/<package>/ or /Android/media/<package>/). If you find .jpg files there, the app was hiding, not encrypting.
4. Are the photos still in your gallery? Some apps copy instead of move — if the originals are still in DCIM, you've lost nothing but access to the app.

If you found readable JPEGs in a folder, you're in Case A.

Case A: the app was hiding files (most likely recoverable)

Things to try, in order:

• Check the gallery's "recently deleted". Many vault apps delete from the gallery after import, and that lands in the system trash for 30 days.
• Look inside the app's folder with a file manager. Even if the files are named nonsense, a .jpg extension plus a thumbnail is enough. Copy them to DCIM and they'll reappear in the gallery.
• Check for an export function before the app locks. Some apps allow exporting from a settings screen without the PIN — if so, do it now.
• Restore the app's data from a backup. If you had Google backup or a manufacturer backup enabled, restoring the app can restore its private folder.

Caveat: on Android 11+, /Android/data/** is not readable by most file managers without a workaround (Shizuku, or a file manager with SAF access). You may need a specific file manager or a computer with ADB. This is tedious, and it's the price of a "hidden folder" app that never encrypted.

Case B: the files were encrypted (not recoverable without the key)

If the files are unreadable blobs, and the app offers no reset path, then the only route back is:

• A recovery code / recovery key you were told to save at setup. Look in your notes, password manager, photos of papers, email to yourself. If you printed it, it may still be in a drawer.
• A biometric unlock that still works. Sometimes the PIN is forgotten but the fingerprint still opens the vault. If so: open it, export everything, then set a new PIN.
• The device that was already unlocked. Some vault apps remain open while the app is in memory; do not reboot the phone.

There is no third option. An app that says "contact support and we'll unlock it" is either not encrypting or is lying about it — and a tool that claims it can crack a vault of this type is malware.

Why we designed our own vault to be "unrecoverable"

Keep Photo: Photo Vault derives the key from your PIN with Argon2id and stores the encrypted files with no copy of that key anywhere. That has one consequence we state on the product page: if you lose both the PIN and the recovery code, the photos are gone.

We chose that trade deliberately, because the alternative — a server holding a copy of your key — makes the whole thing theatre. What we do instead:

• A recovery code at setup, shown once, that you're asked to store offline.
• An export test on day one, so you find out the export works while you still remember the PIN, not two years later.
• A verify step on every export that checks the files byte-for-byte and tells you which ones passed.

Preventing this, whichever app you use

• Write the recovery code on paper and put it with your passport, not in a screenshot on the same phone. If you're still deciding which app, this checklist is the one to run first.
• Test the export in the first week. One photo, out and back in.
• Don't use a PIN you use elsewhere, and don't pick one you'll forget in a year.
• Keep a copy of the things you can't lose somewhere else. A vault is protection, not a backup. Encrypted and on one phone is still one copy.

FAQ

Can a factory reset recover vault photos?

No. The encryption keys live on the device's storage; a factory reset destroys them. Restoring the phone from a full system backup may restore the app's encrypted data, but you'd still need the original PIN or recovery code.

Are the hidden photos in my gallery's trash?

Only if the app deleted them from the gallery after importing. That's common: import → delete original → original sits in "Recently deleted" for 30 days. Check there first, it costs nothing — and if it's not there, walk the six places Android hides photos before giving up.

Do "vault recovery" apps on the Play Store work?

They recover photos deleted by you, from the gallery trash or backups. None of them can decrypt a real vault. If an app promises that, it's either fake or hostile.

Does the app developer keep a copy of my photos?

If it's a real encrypted vault: they can't, even if they wanted to. If an app offers a "we can restore your vault by email" feature, then a copy of your key (or your files) exists somewhere — that's worth knowing before you put ID documents in it.