Skip to content
ARCA

Arca vs Private Photo Vault

Private Photo Vault (Pic Safe) is one of the most downloaded photo-hider apps on iOS, marketed as “100% private.” Independent security researchers, however, found that older versions stored photos without real encryption and could be opened quickly with forensic tools.

Feature
Arca
Private Photo Vault
Real per-file encryption (AES-256)
AES-256-GCM, per file
Researchers found photos stored unencrypted in older versions
Zero-knowledge (no one else can read your photos)
Yes — key derived from your PIN
Not demonstrated
Works with no account
No sign-up at all
Optional account for cloud features
Fully local — no server
Nothing leaves the device
Cloud backup / sync offered
Decoy / duress vault
Second PIN opens a decoy
Decoy password (“break-in” style features)
Break-in report (failed-unlock log)
Time, PIN, optional photo
Break-in reports offered
Encrypted backup you fully control
Single .arcavault file
Cloud backup tied to the vendor
No lock-in (lossless export, no pay-or-lose)
Export originals anytime
Export available; cloud is vendor-controlled

Based on independent research (IOActive, Zdziarski) and public information. App versions change — verify the current version's behavior before relying on it.

What the table actually means

The core difference is verifiability. Private Photo Vault markets itself as “100% private,” but that promise lives in the marketing copy, not the architecture: independent researchers found that older versions stored photos without real encryption, which meant standard forensic tools could recover them from a device. A vault is only as private as its documented cryptography — a slogan can't encrypt anything.

Arca's privacy claims are structural rather than promotional. Every file is encrypted with AES-256-GCM on your device, the key is derived from your PIN with Argon2id, and there is no account, no server, and no vendor cloud holding your originals. There is nothing to breach on our side, because nothing of yours is on our side.

Which one should you choose?

If what you want is a managed experience — vendor cloud backup, sync across devices, recovery handled by someone else — an account-based vault like Private Photo Vault offers that convenience, in exchange for trusting the vendor's infrastructure and its current implementation.

If your requirement is that nobody else can ever read your photos — not an attacker, not a subpoenaed cloud provider, and not the vendor itself — then the architecture matters more than the feature list. A local-only vault with documented per-file encryption is the stronger default, and that is the design Arca ships.

Switching to Arca

Migration is a one-time, three-step move. First, export your originals from your current vault back to the Photos app and confirm the count matches what you expect. Second, import them into Arca — they are encrypted on-device as they come in. Third, verify a few photos open correctly in Arca, then delete the originals from the old app and from Photos, including the Recently Deleted album.

Once everything is inside, create an encrypted backup — Arca writes a single .arcavault file you can keep on a computer or external drive. That backup is yours: it doesn't depend on any vendor's cloud staying online or any subscription staying active.

Where Arca stands

Arca takes the opposite approach: every file is encrypted with AES-256-GCM on your device, there's no account or server to breach, and you can verify the design rather than trust a slogan.

Questions

Is Private Photo Vault actually private? +

Security researchers (IOActive, Zdziarski) found that older versions stored photos without real encryption, meaning files could be recovered with forensic tools. Always check the current version's documented encryption before trusting any vault.

How is Arca different from Private Photo Vault? +

Arca encrypts every file with AES-256-GCM using a key derived from your PIN, has no account or server, and lets you export your originals losslessly at any time. There is no cloud vendor in the middle.

Can I back up my photos without a cloud account? +

Yes. Arca exports your entire vault as a single encrypted .arcavault file that you can store on a computer or external drive. Backup stays under your control instead of living on a vendor's servers.

Does Arca upload my photos anywhere? +

No. Encryption and storage both happen on your device, and there is no Arca server involved. The honest trade-off: because no one else holds your data, keeping a backup is your responsibility — which is what the .arcavault export is for.

Your photos. Truly private.

Download Arca and lock your first photos away in under a minute. No account, no cloud, no one but you.

Free to download · iPhone · iOS 18+