Calculator vault apps: how they work, whether they're safe and how to find one on a phone

How calculator vault apps work

On the home screen the app is a calculator, and usually a working one. Type a PIN as if it were a calculation – often followed by the equals sign – and a private gallery opens instead. The idea is that nobody looking at the phone would think twice about a calculator.

Are calculator vault apps safe?

Two academic studies looked at popular Android vault apps, and the results are sobering:

• A 2022 study of 20 popular Google Play vault apps found that only 5 used any encryption. Someone with basic Android knowledge recovered private files from 15 of the 20 without rooting the phone.
• Some apps only renamed file extensions or used hidden folders – which anyone can show with a file manager. PINs and recovery emails were found in plain text in 7 apps.
• A 2017 study of 18 vault apps with almost 220 million downloads found that 6 didn't encrypt photos, 8 didn't encrypt videos and 7 stored passwords in plain text.
• Forensic tool makers say their software can recover keys and PINs even for some apps that do encrypt, especially when a short numeric PIN protects the key.

A disguise is not encryption. A calculator icon hides that an app exists; it does nothing to protect the files if someone gets to them another way.

Other risks to know about

• Uninstalling the app usually deletes the photos: Android removes an app's own files when it is uninstalled.
• Clearing the app's storage in Settings deletes everything in it – easy to do by accident on a “calculator”.
• The Data safety label on Google Play is filled in by the developer; it isn't an independent check of the app's encryption.

How to tell if a vault app really encrypts your files

• Look for a clear, specific description of the encryption – which algorithm, and how the key is made from your password. Vague promises are a warning sign.
• Be wary if the app lets a short numeric PIN be the only protection for the key.
• Check whether there is a recovery key that only you hold. If the developer can “reset” your password, they can open your files.
• Be honest about limits: an ordinary user can't audit an app's encryption, so prefer apps that explain theirs in detail.

How to find a hidden or disguised app on Android

1. Check the full app list. Settings > Apps > See all apps lists installed apps even when their icon is hidden or disguised. Menu names vary by phone.
2. Compare names. In the 2022 study, 17 of 20 vault apps showed a different name or icon in the app list than on the home screen – for example a calculator listed under an “app lock” name. Two calculators are also a clue.
3. Check Google Play. Play Store > your profile picture > Manage apps & devices > Manage shows installed apps.
4. Look at storage. A real calculator in the study took about 6 MB; a disguised vault took 35 MB or more before any files were added.
5. Check built-in hiding. On Samsung phones, Home screen settings > Hide apps on Home and Apps screens lists hidden apps. Android 15's Private Space and Samsung's Secure Folder can also hold apps.

For parents

Warnings about calculator vault apps have come from police and schools for years. The most effective step is an open one: Google Family Link lets you require approval for downloads (Controls > Google Play > Require approval) and see and block apps under App limits. Talking with your child works better than searching their phone in secret. This guide doesn't support checking another adult's phone without their consent.

Frequently asked questions