Album Shield — Security
Updated October 31, 2026
This page describes how Album Shield protects your photos and videos, and — just as importantly — where that protection ends. It is written so that a technically minded reader can judge the design rather than take a marketing claim on trust.
Encryption
Every file Album Shield writes is encrypted with AES-256-GCM, using Apple’s CryptoKit implementation. GCM is an authenticated mode: it detects tampering as well as preventing reading. Each encrypted file stores its own nonce, ciphertext and authentication tag together, so no file depends on a separate record to be decrypted.
This covers more than the images themselves. Full-resolution media, generated thumbnails and the vault index are all encrypted. The index is what holds your file names, folders, tags, edits and any location data read from a photo’s metadata. That matters: a list of folder names can reveal as much about someone as the pictures inside them.
The vault key
A 256-bit key is generated on your device the first time you set up the vault. It is stored in the iOS Keychain with two properties that define the product:
- Access control requires your presence. The key is released only after Face ID, Touch ID or your device passcode succeeds.
- It is marked device-only. The key is excluded from iCloud and encrypted computer backups, and it cannot be migrated to another device.
The key is never transmitted anywhere. There is no server to send it to.
Unlocking
The vault opens with Face ID, Touch ID or your device passcode. An optional PIN can be enabled as an additional way in.
PIN unlock, Duress PIN and the decoy vault
When you set a PIN, the vault key is wrapped with a key derived from that PIN and 32 bytes of random salt, stretched over 100,000 iterations of SHA-256. The wrapped package is stored in the Keychain and is also marked device-only, so it is excluded from backups.
The Duress PIN opens a separate vault with its own independently generated key — not a filtered view of your real one. The two wrapped packages are written identically and carry no marker saying which is which. The only thing that distinguishes them is that decryption succeeds with one PIN and fails authentication with the other. Someone examining the device cannot tell from the stored data which PIN leads to the real vault, or that a second vault exists at all.
Being precise about the PIN’s role: iteration counts raise the cost of guessing, but a numeric PIN has limited entropy no matter how it is stretched. The PIN is an additional layer, not the foundation. The foundation is the Keychain’s device-only protection, which is enforced by the device’s own hardware and requires compromising iOS data protection before any of this material can even be read.
Break-In Log and lockouts
Repeated wrong PIN entries trigger escalating lockout delays. After a failed attempt, Album Shield can capture a front-camera photo and timestamp and store it — encrypted, in the vault — so you can see who tried.
Temporary files
Some operations cannot work purely in memory. Video playback requires a file that the system media player can read, and exporting or sharing produces a decrypted copy by definition. Album Shield handles these as follows: temporary files are written inside the app’s own container with iOS complete file protection, excluded from device backups, deleted as soon as the operation finishes, and cleared again when the vault locks and when the app next starts — so an interrupted session cannot leave a readable file behind.
What Album Shield never does
- No account, no sign-in, no user identifier.
- No server receives your media, your key, or information about what you store.
- No analytics, tracking or advertising frameworks.
- No key escrow and no developer backdoor. There is no recovery key held by anyone.
Limits of this protection
There is no cloud backup, and no cross-device restore. This is a deliberate design choice — it is why no server can be compelled or breached — but the consequence is real. If your device is lost, destroyed, erased or replaced, the vault goes with it. Export anything you cannot afford to lose. Restoring a purchase restores only the purchase, never your media.
Exported copies leave this protection entirely. A photo saved to Apple Photos or Files, or shared to another app, is an ordinary unencrypted file from that moment on, and is included in whatever backups that destination uses.
On-device protection assumes the device itself is sound. Album Shield relies on iOS data protection and the Keychain. A jailbroken, malware-infected, or unlocked-and-handed-over device undermines assumptions no app can restore. Use a device passcode and keep iOS updated.
No third-party security audit has been performed. The design described on this page has not been independently reviewed or penetration tested. It is described here in enough detail that a knowledgeable reader can evaluate it, which is the most honest thing an independent developer can offer in place of an audit they have not purchased.
Reporting a security issue
If you believe you have found a vulnerability, please report it to Support@bstonemedia.com with enough detail to reproduce it. Reports are read by the developer directly. Please allow reasonable time for a fix before publishing.