A vault that cannot phone home
Files go in encrypted. The password you chose is the only thing that opens them again — and the app has no permission to send anything anywhere.
Most vault apps do not encrypt anything
Independent teardowns in early 2026 found that many popular photo hiders just
put a PIN screen in front of your files. Pull the storage into a computer and
the pictures are still there, still readable, still named
IMG_4471.jpg.
You should not take our word for the opposite either. Here is the same test, run against this app, on real on-device storage:
# the encrypted file, straight off the phone $ xxd -l 48 vaults/4fafaa87/cbb4a430.enc 00000000: 4c4d 4656 4155 4c54 0101 0000 0000 1000 LMFVAULT........ 00000010: 2300 0000 0000 0000 b0cf 480e 65f9 5274 #.........H.e.Rt 00000020: 9279 8102 c605 493c 4c7a f21f c891 faee .y....I<Lz...... # search every stored byte for the file's real contents, # its name, and the password $ grep -a "account 123-456-789" vault.db vault.db-wal *.enc clean: appears nowhere $ grep -a "notes.txt" vault.db vault.db-wal *.enc clean: appears nowhere
What makes this one different
It has no internet permission
Not a promise in a policy — the permission is absent from the app. Android refuses network access regardless of what the code asks for. Open the app info screen and look.
File names are encrypted too
Encrypting contents while divorce-papers.pdf sits in a
database is not privacy. Names, sizes and types live inside the encrypted
blob.
One file can have its own password
Separate from the vault. Someone holding your vault password and your recovery words still cannot open that file, or see its name.
Opens inside the app
Photos, video, audio and text play in the vault. Nothing is handed to another app just to look at it.
There is no password to steal
No verifier is stored, so there is nothing to check a guess against. The only way to test a password is to run the full key derivation — about a second per attempt.
You pay once
A vault on your own phone has no servers and no bandwidth. There is nothing to bill monthly. The market leader charges up to $120 a year.
How it compares
| Lock My Files | Cloud vault apps | Typical free hider | |
|---|---|---|---|
| Encrypts file contents | Yes | Usually | Often not |
| Encrypts file names | Yes | Rarely | No |
| Works with no network permission | Yes | No | No |
| Needs an account or email | No | Usually | Sometimes |
| Can staff reset your password | No | Often yes | Often yes |
| Price | $14.99 once | Up to $120/yr | Free, ad-funded |
What it does not do
Read this before paying for anything. These limits are real and permanent.
- Nobody can reset your password. No account, no support desk, no recovery email. Each vault gives you 12 recovery words at creation; lose those and the password and the files are gone.
- Nothing is backed up. Lose the phone and the vaults go with it. A vault is not a backup — it is the opposite of one.
- The original file stays where it was. Adding a file copies it. The original sits in your gallery until you delete it, and the app says so at the time.
- Playing a video writes it out briefly. The player needs a real file, so a decrypted copy lives in the app's private storage while it plays and is deleted when you close it. Photos and text never touch disk.
- The vault's name is stored in the clear. It has to be, so the app can list vaults before anything is unlocked. Call one "Documents", not something you would not want read aloud.
Questions
What happens if I forget my password?
The files are gone, permanently. That is not a gap — any app that can reset your password can also open your data without you. Your 12 recovery words are the only way back, which is why the app makes you confirm you wrote them down. The longer answer.
How do I know it really encrypts?
Check it. The method takes about fifteen minutes, needs only
adb, and works on any vault app including this one.
Here is how.
Why does it cost money when others are free?
Free vault apps are funded by ads or by selling a cloud subscription. Both require the app to talk to a network, which is the one thing this app cannot do. One payment is the only model compatible with having no internet permission.
Is there a cloud backup?
No, and there will not be one in this app. A backup would require network access and a server, and the entire claim rests on having neither.
Does it hide the app itself?
No. Disguising a vault as a calculator is a popular feature and a bad idea: it is the first thing anyone who suspects a vault looks for, and it encourages people to rely on concealment instead of encryption.
Is the source code available?
Not currently. That is a fair thing to hold against a security product, and the honest answer is that the published verification method exists precisely so the claims can be checked without it.
Not out yet
Both store listings are in progress. If you want to know when it lands, email hello@lockmyfiles.app. That is the entire mailing list — no tracking pixel, no drip sequence, one message when it ships.