Fotolok is a private photo and video vault for Android. Every item you hide is encrypted with AES-256-GCM, not just renamed or moved, and the key is created on your phone and kept in the Android Keystore.
There is no account and no cloud. Your photos and videos stay on your phone. The app can look like a working calculator, can open a decoy vault with a second PIN, and keeps a log of failed attempts to open it.
What it does
Real AES-256-GCM encryption
Each photo and video is encrypted before it is stored in the vault, and any change to the file is detected. The key is generated on your phone and cannot be exported from the Android Keystore.
Calculator disguise
Turn the app icon into a working calculator named Calculator. To open the vault, press and hold the calculator's top bar, then enter your PIN.
Decoy vault
Set a second PIN that opens a separate vault holding only the photos you choose to put there. If someone makes you open the app, enter the decoy PIN instead.
Recovery word for a forgotten PIN
You can add a recovery word. If you forget your PIN, the word on the Forgot PIN screen lets you choose a new one and your photos stay. A wrong word counts as a wrong PIN.
Fingerprint
Fingerprint is optional and off until you switch it on. If a new fingerprint is added to the phone, Fotolok turns it off and asks for your PIN.
Failed-attempt log
See when someone tried to open your vault and failed, with the time and how many characters they typed. No photo is taken and the app has no camera permission.
Encrypted backup you control
Save an encrypted backup file with a passphrase you choose, anywhere you like through Android's file picker. Restore it on a new phone or after reinstalling.
Locks itself
The vault locks when you leave the app for a while, or when you turn the phone face-down if you switch that on. Screenshots and screen recording are blocked inside the app. Repeated wrong PINs bring longer waits, and you can choose to erase the vault after too many.
Where your data lives
Your hidden photos and videos are encrypted and stored in the app's private storage on your phone. They are never uploaded. Your PIN and recovery word are stored only as salted hashes, and the app has no account. The only thing Fotolok sends is an automatic crash report if the app crashes, handled by Firebase Crashlytics. It holds technical error details and the phone model, never your photos, videos or PIN. Backup files are made only when you ask, and you choose where they go. Android's automatic cloud backup is turned off for the app.
Questions
Is Fotolok real encryption or does it just hide photos?
It is real encryption. Every photo and video is encrypted with AES-256-GCM before it is stored in the vault, and the app reads a file only after checking it has not been changed. Files are decrypted only when you open them, so copying them off the phone gives only encrypted data.
Where is the encryption key stored? Is it based on my PIN?
The key is a random AES-256 key generated on your phone and kept in the Android Keystore, where it cannot be exported. It is not made from your PIN. The PIN is what lets you into the app, and it is stored only as a salted hash, so Fotolok cannot show it to you.
What if I forget my PIN?
If you added a recovery word, tap Forgot PIN on the lock screen, enter the word and choose a new PIN. Your photos stay. Without a recovery word, the PIN cannot be reset by you or by us, because we hold no copy of anything. You can keep trying, with waits after wrong tries.
What if I forget both my PIN and my recovery word?
Then the vault stays closed. There is no account, no reset and no back door, and the developer cannot open it. Clearing the app's data or uninstalling makes Fotolok usable again, but deletes the vault for good. Only an encrypted backup you made earlier, plus its passphrase, can bring the photos back.
What happens to my photos if I uninstall Fotolok?
They are deleted. The encryption key lives in the Android Keystore and goes with the app, so the encrypted files cannot be read afterward. If you want to keep them, make an encrypted backup first and restore it after reinstalling. Photos you unhid to your gallery stay there.
Can I back up my vault or move it to a new phone?
Yes. In Settings, create an encrypted backup. You choose a backup passphrase, separate from your PIN, and save the file wherever you like. Fotolok never uploads it. Restore it on the new phone with the same passphrase. The passphrase cannot be recovered if you lose it.
Does the calculator disguise hide the app completely?
No. The home screen icon becomes a working calculator, but Fotolok is still listed in Android Settings, in your phone's app search and in the Play Store. Android does not let an app hide fully. Fingerprint is not available while the disguise is on; you use the gesture and your PIN.
Does Fotolok work on tablets?
Yes. Phones use portrait. Tablets and open foldables can rotate, and the screens keep a readable width on large displays.
Requirements
- Android 8.0 or later
- Phones and tablets
More from LogicGateGames
QuiNotesNotes and checklists, with search that reads the text inside your images.
ThecaA file manager, a cleaner and an encrypted vault in one app.
DiurnaA planner and journal you can restyle to suit how you think.
PermittoPractice for the US learner's permit test, for all 50 states and DC, in English and Spanish.
WAKEMAn alarm that stays on until you finish the task you set it.
Folio PDF Editor, Reader, ScanRead, annotate and edit PDFs. Scanning, redaction and Office-to-PDF included.
Privacy policy · Terms. Questions, bugs and feature requests go to logicgategames@gmail.com — it is read by the person who wrote the app.