Updated August 2026 · Every price, permission and encryption claim below is quoted from Google, Samsung, Cryptomator, Keepsafe or a primary security report, read on 19 August 2026 · the Cryptomator price and the Secure Folder encryption toggle are new
Start with what is already on your phone because Samsung's and Google's own pages, read 19 August 2026, document Secure Folder and Private Space free. Cryptomator is the pick for anything sensitive because its own project hosts a 2017 Cure53 audit report you can read yourself. Keepsafe is the mainstream choice if a PIN and a decoy are enough because its Play listing, read 19 August 2026, shows 4.7 stars from 2,069,904 ratings with real Break-In Alerts and Fake Pin features. Data checked: 19 August 2026.
A vault app or a hidden folder solves a specific problem: keeping a few private photos or documents away from a casual look at your phone. What it does not always solve is the deeper one, because a lot of "vault" apps only hide a folder behind a PIN without encrypting anything, and at least one well-known app used encryption so weak it took an outsider a few hours to defeat it. This page starts with what your phone already gives you free, covers the apps worth installing, and is explicit about which layer, hiding or encrypting, each one actually gives you.
What is already free
The features built into your phone are usually the safest starting point, because they are maintained by the company that made the operating system and tie into the phone's own secure storage. Try these before installing anything.
Samsung Galaxy: Secure Folder. Samsung's own support article, dated 25 August 2025 and read 19 August 2026, gives the setup path: "Navigate to and open Settings, then tap Security and privacy, and then tap More security settings. Tap Secure Folder." Everything inside sits behind a separate passcode, and Samsung documents hiding the folder entirely, either with a two-finger swipe down to Quick Settings and a tap on the Secure Folder tile, or through the same Settings path.
Secure Folder's encryption is a separate switch, not a default. Samsung's own page states it plainly: "For added security, you can turn on enhanced encryption in Secure Folder to help keep your data safe from advanced cybersecurity threats," reached by opening Secure Folder, tapping More options, then Encrypt. The same page warns "All apps and their notifications will stop working" while encrypted. So the passcode lock is on by default; the actual encryption is a step you have to take yourself, which is exactly the PIN-versus-encryption distinction the rest of this page is about, showing up inside the recommended built-in option itself.
Android 15 and newer: Private Space. Google's own help page, read 19 August 2026, states the requirement directly: "Is running on Android 15 and up." It is a sealed profile at the bottom of the app drawer; locked, its apps vanish from your app list, recent apps and notifications, and Google documents moving files in too: "You can move or copy files from your main profile into private space... Tap + Add. Tap Add files."
Everyone else: Safe Folder in Files by Google. Open the app, go to Collections, tap Safe folder, and set a PIN or pattern. Google's own help page carries a warning worth repeating in full: "Important: If you forget your PIN or Pattern, you can't access your files." The same page confirms the feature works from "Android 8.0 and up."
The distinction that matters
This is the distinction most vault-app write-ups skip, and it decides whether a "vault" is actually protecting anything.
Many vault apps simply move your files into a hidden folder and put a PIN screen in front of the app. The files themselves sit on storage unchanged. Anyone who plugs the phone into a computer, pulls the storage, or uses a file recovery tool can often read them straight off the disk, because the lock was only ever on the app's front door, not on the files. Real encryption scrambles the file contents with a key derived from your password, so the bytes on disk are useless without it. That is the protection you actually want for anything sensitive.
Match the tool to the threat. Hiding from a casual look at your gallery? A built-in folder or a simple hider is enough. Worried about theft, a repair shop, or a determined person with your unlocked phone? You want genuine encryption, ideally from code that has been independently checked rather than taken on the developer's word.
Real encryption, audited
3.6 stars from 1,644 ratings · 50K+ installs · $29.99 one-time purchase · no ads · by Skymatic GmbH · Play listing updated 26 June 2026 · checked 19 August 2026 · Play listing
The only app on this page whose encryption claim has been checked by outside experts rather than taken on trust. It is a real file vault, not a tap-and-hide gallery, and there is a small learning curve because of it.
Skip it if you want a free, no-friction way to hide a handful of photos, since the F-Droid build still requires setting up a vault. Choose it over Keepsafe or Gallery Vault for anything you would actually mind someone reading, since it is the only one here with an independent audit behind the encryption claim.
The long-running mainstream pick
4.7 stars from 2,069,904 ratings · 50M+ installs · free to install, in-app purchases $0.99 to $299.99 per item · contains ads · by Keepsafe · Play listing updated 10 August 2026 · checked 19 August 2026 · Play listing
Around since 2011 and the largest install base here by a wide margin. It gives you PIN and fingerprint locking, album organisation, cloud sync, and a genuinely useful decoy PIN, but its own store listing leans on marketing language worth reading carefully.
Skip it if you want the encryption claim independently checked rather than taken from the store page, since Cryptomator is the one with an audit behind it. Choose it over Cryptomator when ease of use matters more than an audited encryption claim, and a PIN plus a decoy is enough for your threat model.
A second mainstream option to compare
4.4 stars from 605,791 ratings · 50M+ installs · free to install, in-app purchases $0.99 to $48.99 per item · contains ads · by GalleryVault Developer Team · Play listing updated 17 August 2026 · checked 19 August 2026 · Play listing
A second large, actively updated hider app, useful as a comparison point rather than a clear pick over Keepsafe. Read its own permissions before installing, the same way you would any app in this category.
Skip it if you specifically want the largest, most reviewed name in the category, in which case Keepsafe has the deeper review base. Choose it over Keepsafe only if you prefer its specific interface or its slightly cheaper entry-level purchase, since the underlying protection model is the same PIN-based hiding.
The history to know
The reason to be picky is not paranoia; it is precedent, and the clearest example is well documented.
NQ Vault advertised AES encryption. On 7 April 2015, The Register reported that a researcher working under the alias NinjaDoge24 had analysed the app and found it used only "single-byte XOR" to scramble the first 128 bytes of a test image file, "everything after the first 128 bytes remains untouched." XOR with a single-byte key is trivial to reverse; the researcher built a "dumb" tool that brute-forced it in short order. At the time, The Register noted, NQ Vault "has been downloaded more than 10 million times on the Google Play store alone."
The company's own response is worth reading, because it is technically true and still misses the point. NQ told The Register its security was "appropriate," stating that "Image and video files are stored in a format not readily readable by other applications and can only be viewed in Vault after entering the correct password on the device... These standards are appropriate for the consumer use cases this application is meant for." A separate security researcher, Wade Alcorn, was blunter about what that actually meant: "If this is the case it should not be considered a mechanism to protect data."
The lesson holds regardless of which specific app you are looking at today: an app claiming "military-grade encryption" on its store page proves nothing about what its code actually does. You cannot inspect a closed-source app's encryption yourself, which is why an independently audited, open-source option is worth the friction it adds.
How far a decoy goes
A decoy or fake vault gives you two PINs. One opens your real hidden content; the other opens a separate, harmless-looking vault you can show if someone pressures you to unlock it. Keepsafe's own Play listing names this feature directly, "Fake Pin: Creates a decoy Keepsafe with a separate PIN code."
It is a clever idea with real limits. It helps in a casual or coerced situation where someone glances and moves on. It does nothing against anyone who already knows the trick exists and simply asks for the other PIN, and it does not touch the underlying question of whether your files are encrypted at all. Treat a decoy as social cover, not a technical safeguard.
Layering it all
Hiding files is one layer. Stopping someone from opening the apps that show them is another. If your phone or your chosen vault lacks a per-app lock, a dedicated locker can sit in front of your gallery, messages or file browser; see our roundup of app lock apps for Android for options that pair well with a vault. Many gallery apps for Android now include their own hidden or locked album too, which can be enough if you only need to keep a few shots out of the main grid; our gallery apps roundup covers those. For moving files into whichever vault you choose without fuss, pair it with one of the file manager apps for Android. For a wider look at privacy and storage tools, browse the tools and utilities hub.
Layering these is sensible: a built-in encrypted folder or an audited vault for the sensitive material, an app lock on whatever touches it, and a tidy gallery so private shots never land in the main feed in the first place.
No. Many vault apps only hide files behind a PIN screen while the files themselves stay readable on storage; a file recovery tool can often pull them straight off the disk. Real encryption scrambles the file contents with a key derived from your password, so the bytes on disk are useless without it. For anything genuinely sensitive, choose a built-in encrypted folder or an audited, open-source tool like Cryptomator rather than a simple hider. Checked 19 August 2026.
Because it shows an app's encryption claim can be almost entirely false while still being marketed as secure. The Register reported on 7 April 2015 that NQ Vault, downloaded more than 10 million times on Google Play, only applied single-byte XOR to the first 128 bytes of a file, leaving the rest untouched. NQ's own response called this "appropriate" for its use case; a separate security researcher said it should not be considered protection at all. Checked 19 August 2026.
It depends on your device. Samsung phones have Secure Folder, and Samsung's own page notes that enhanced encryption there is a separate toggle you turn on yourself, not automatic. Phones on Android 15 or later have Private Space. Other phones can use the Safe Folder in Files by Google, on Android 8.0 and up, though Google warns plainly that its PIN cannot be reset if you forget it. Checked 19 August 2026.
It gives you a second PIN that opens harmless content, which Keepsafe's own listing describes as "Creates a decoy Keepsafe with a separate PIN code." It helps if someone casually pressures you to unlock the app. It does not help against anyone who knows the feature exists and asks for the real PIN, and it does not make your files encrypted. Treat it as social cover, not technical security. Checked 19 August 2026.
If the app only hid the files without encrypting them, recovery tools can often pull them off storage even after deletion. Truly encrypted files are unreadable without the key, so a reset that wipes the key effectively destroys them. That difference is exactly why encryption matters more than hiding.
Only if you know how the keys are handled. Keepsafe's own Play Data safety section says the app may share data with third parties and may collect data, which is a different guarantee than a vault where only you hold the key. Cryptomator can keep a vault in cloud storage of your choosing while the encryption happens on your device first, which is the stronger model for cloud backup. Checked 19 August 2026.
The main Play listing is a one-time $29.99 purchase; Cryptomator's own pricing page confirms personal use is free but "Full access on Android" is a separate €29.99 charge from the desktop and iOS versions. A free route exists through the F-Droid build listed on the developer's own site. A newer, smaller freemium listing also appeared on Play in June 2026, still too new to have a rating. Checked 19 August 2026.
Checked 19 August 2026: this page named Cryptomator and Keepsafe without linking either, so both now carry their own Play figures, and Gallery Vault has been added as a second verified mainstream comparison. The correction that changes what a reader does: the page never stated that the Play version of Cryptomator costs money; its listing is a one-time $29.99 purchase, confirmed on Cryptomator's own pricing page, "Full access on Android €29.99," with the free route being the F-Droid build the page already mentioned. A newer, still-thin freemium listing on Play, released 26 June 2026 with 1K+ installs and no rating yet, is noted separately rather than treated as an equivalent to the established app. The audit claim, "independently audited (Cure53 in 2017)," carried no source and now links Cryptomator's own hosted copy of the report. The NQ Vault story is rewritten with the primary source: The Register, 7 April 2015, names the researcher's alias, the exact technical finding, NQ's own quoted response, and a second expert's corroboration, none of which the page previously carried. Keepsafe's "Fake PIN," "album locks" and "break-in alerts" are now quoted verbatim from its own Play description rather than paraphrased. Samsung's Secure Folder was described as "encrypted... backed by Samsung Knox" as a default state; Samsung's own page shows encryption is a separate toggle, off by default, that stops all apps and notifications from working while active, which the page now quotes directly. A stated Private Space requirement of "more than 6GB of RAM" and a claim that file moving arrived "From Android 16 QPR2 onward" could not be confirmed on Google's current help page and have been removed rather than repeated. The Files by Google warning that a Safe Folder PIN cannot be reset is now Google's own exact wording. A decision table, an "Our answer" capsule, a dated verification box and this changelog are new.
How to Actually Free Up Storage on AndroidTools & Utilities
How to Speed Up a Slow or Laggy Android PhoneTools & Utilities
How to Transfer Files Between Android and a PCTools & Utilities