Prive › Security
How Prive encrypts your photos
Short answer: Prive encrypts each photo and video on your iPhone with AES-256-GCM (Apple CryptoKit), using a random 256-bit key created on your device. The key stays in your iPhone's Keychain and in iCloud Keychain, which Apple end-to-end encrypts. Prive has no account and no servers, so the developer never receives your photos, your key or your PIN.
At a glance
| Encryption | AES-256-GCM (authenticated encryption) through Apple CryptoKit |
|---|---|
| Encryption key | A random 256-bit key generated on your iPhone when you set up Prive |
| Where the key lives | Your iPhone's Keychain, synced through iCloud Keychain (end-to-end encrypted by Apple) so your other devices can open the vault. Readable only while your iPhone is unlocked. |
| Encrypted by Prive | Photos, videos, Live Photo videos, thumbnails, the on-device search index and break-in photos |
| Account | None. No sign-up, email or login |
| Servers | None. The developer never receives your photos, key or PIN |
| Backup | Optional, to the private iCloud database of your own Apple Account |
| App Store privacy label | Data Not Collected |
| Independent audit | Not yet. This page documents the design so you can judge it yourself |
What happens when you add a photo
- You import from Photos, take a picture inside Prive, save from the private browser, or send it from your computer with Wireless Transfer.
- Prive encrypts the file on your iPhone with AES-256-GCM and a fresh random 96-bit nonce. Large videos are encrypted in chunks, each with its own nonce, so a whole video never sits unencrypted in memory.
- Only the encrypted file is written to Prive's storage. A small thumbnail is created and encrypted the same way.
- If you choose, Prive deletes the original from your Photos library (Settings → Delete from Photos After Import). Empty Recently Deleted in the Photos app too.
GCM is authenticated encryption: if a single byte of an encrypted file is changed or damaged, decryption fails instead of returning corrupted data. Prive's Verify Vault tool uses this to check that every file is intact.
Search without uploading anything
Prive can find photos by the words and objects in them. The analysis runs on your iPhone with Apple's Vision framework, and the search index it produces is encrypted with your key like everything else. Nothing is sent to a server for recognition.
PIN, Face ID and the Recovery Key
- PIN. You choose a 6-digit PIN. It is separate from your iPhone passcode, and Prive stores only a hash of it in the Keychain, never the PIN itself.
- Face ID / Touch ID. Handled by iOS; Prive never sees biometric data. If Face ID fails, Prive asks for its own PIN, not your iPhone passcode.
- Brute-force protection. After 5 wrong PINs Prive locks for 30 seconds; after 10, for 5 minutes. Optional break-in alerts take a front-camera photo of whoever is guessing.
- Auto-lock. By default the vault locks the moment you leave the app, and its contents are covered in the app switcher.
- Album passwords. Any album can have its own password on top of the vault PIN.
- Recovery Key. Your 256-bit key written as 24 words (BIP-39 format with a checksum, so a mistyped word is caught). It resets a forgotten PIN and recreates your key if iCloud Keychain ever loses it. Anyone with these words and your encrypted data can open your vault, so keep them on paper, offline.
What goes to iCloud, and what doesn't
iCloud Backup is off until you turn it on. When it is on, Prive uses the private CloudKit database inside your own Apple Account:
| Data | How it is stored in iCloud |
|---|---|
| Photos, videos, Live Photo videos | Encrypted by Prive (AES-256-GCM) before upload |
| Thumbnails and search index | Encrypted by Prive before upload |
| Your encryption key | In iCloud Keychain (end-to-end encrypted by Apple), never in the backup itself |
| Your PIN | Only as a hash, in iCloud Keychain |
| Album names, dates, file sizes and other organizing details | In your private iCloud database, protected by Apple's iCloud security rather than by Prive's own encryption |
The developer has no access to your private iCloud database. To restore on a new iPhone, sign in with the same Apple Account with iCloud Keychain turned on, install Prive and tap Restore from iCloud.
Wireless Transfer
Wireless Transfer lets you send photos from a computer's browser on the same Wi-Fi. It runs only while the vault is unlocked and the Wireless Transfer screen is open, every upload needs a one-time 6-digit code shown on your iPhone, and it is receive-only: nothing in your vault can be downloaded through it. Files travel over your local network rather than the internet, so use it on a Wi-Fi network you trust, such as at home.
What Prive can't protect against
- Someone who knows your Prive PIN, or who can unlock it with your face or finger.
- Someone who controls your Apple Account and knows your iPhone passcode: they could restore your iCloud Keychain and iCloud data. Use a strong passcode and two-factor authentication.
- Anyone who has your 24-word Recovery Key.
- A jailbroken or otherwise compromised iPhone, and screenshots or screen recordings.
- Copies outside Prive: originals still in Photos or Recently Deleted, other cloud services, or computer backups.
No account, no servers, no tracking
Prive has no sign-up and runs no backend. It contains no ads, no analytics and no third-party SDKs, and its App Store privacy label is “Data Not Collected”. The app only goes online for things you start: iCloud Backup (Apple's servers), the private browser and App Store purchases. Wireless Transfer stays on your local network.
Questions about the design are welcome at prive@vinhdang.app. See also: Prive vs the iPhone Hidden album.
Frequently asked questions
Is Prive end-to-end encrypted?
Your photos and videos are encrypted on your iPhone before they are stored or backed up, and the key stays on your devices and in iCloud Keychain, which Apple end-to-end encrypts. Neither the developer nor Apple can read the photos in your Prive backup. Album names and dates in the backup are protected by Apple's standard iCloud security.
What encryption does Prive use?
AES-256-GCM through Apple's CryptoKit, with a random 256-bit key generated on your device and a new random nonce for every file, or for every chunk of a large video.
Can the developer see my photos or reset my PIN?
No. Prive runs no servers and never receives your photos, key or PIN. A forgotten PIN can be reset only with your 24-word Recovery Key.
What happens if I lose my iPhone?
If iCloud Backup was on, install Prive on your new iPhone, sign in with the same Apple Account and tap Restore from iCloud. If it was off, the vault existed only on the lost iPhone.
Has Prive been independently audited?
Not yet. This page describes exactly how Prive works so you can evaluate it, and we answer technical questions at prive@vinhdang.app.
