Oorvel vs Vaultaire

Unlock: a pattern against six words

Vaultaire opens with a pattern you draw on a 5×5 grid of dots. It is quick, and it lets one phone hold several vaults, each behind its own pattern. That is a real design strength.

The cost is entropy. A 5×5 grid has a very large number of possible patterns, but people do not draw at random. They start in corners, draw letters and shapes, and keep patterns short enough to repeat quickly. Research on Android’s smaller 3×3 unlock patterns found that the patterns people actually choose cluster heavily (Uellenbeck et al.), and that a pattern can be recovered from the smudge it leaves on the screen (Aviv et al.).

Oorvel does not let you choose. It draws six words at random from a list of 7,776. That is 77.5 bits, whatever you are like, because a random draw has no habits.

Encryption: both are sound

Vaultaire encrypts each file with AES-256-GCM. Oorvel uses XChaCha20-Poly1305. Both are authenticated ciphers. Both detect tampering, and neither is the weak point of either app. If you read a comparison that makes much of this row, be skeptical.

Key derivation: where the difference lives

Your unlock secret is turned into a key by a key derivation function, and its job is to make each guess expensive.

Vaultaire’s backup key uses PBKDF2-HMAC-SHA512 with 600,000 rounds. That is a reasonable configuration of PBKDF2. But PBKDF2 costs time, not memory, and graphics cards are built to run many such computations in parallel.

Oorvel uses Argon2id, which requires 256 MiB of memory for every guess. Memory is the resource that parallel hardware cannot cheaply multiply. Combine that with a 77.5-bit secret and the attacker has neither a small space to search nor a cheap way to search it.

Cloud: optional against none

Vaultaire can back up to your private iCloud database, encrypted on the phone first. For many people that is the right trade: if the phone is lost, the vault is not.

Oorvel has no network permission at all. It cannot upload anything, even by mistake, even after an update. Your backup is the sealed export, stored wherever you choose, and the phone-to-phone transfer, which you prove with the restore step before wiping the old phone.

Tracking: on by default against nothing to turn off

Vaultaire’s privacy policy says app analytics and crash diagnostics, through PostHog, are on by default, and that you can turn them off. It also names Apple’s AdServices for install attribution.

Oorvel’s App Store privacy label is Data Not Collected, and the app has no network access through which anything could be sent.

Open source: trust against verification

We could not find public source code for Vaultaire, so its security claims have to be taken on the maker’s word. Oorvel’s app, encryption core and this website are published under the GPL, with instructions to verify a build.

Price

Vaultaire is free to start, with limits on vaults and items, then a weekly, monthly, yearly or lifetime purchase. Prices at the time of writing are on its home page. Oorvel is a one-time purchase with no tiers.

What Vaultaire gets right

• It encrypts every file individually with AES-256-GCM, a modern authenticated cipher, rather than just hiding files behind a screen lock.
• A wrong pattern opens an empty vault instead of an error, so an observer cannot tell a real vault from a decoy, or count how many exist.
• It offers a duress pattern that removes the other vaults from the phone, a feature few apps in the category attempt.
• The iCloud backup is encrypted on the phone before it leaves, and its maker says client-side backup is free for everyone.
• It requires no account, and its analytics can be turned off.
• It publishes long, specific guides that admit what each method does not protect against.

Which one is for you

Choose Vaultaire if you want several pattern-locked vaults, a duress pattern, and an automatic encrypted iCloud backup, and you are comfortable trusting code you cannot read.

Choose Oorvel if you want a secret that does not depend on your habits, no network access at all, and code you can check.

Pick neither if

If you need your photos on more than one device at once, or shared with family, a vault is the wrong tool. Use a shared iCloud Photos library with Advanced Data Protection turned on, and accept that anyone with your Apple Account password gets in.

Frequently asked

Is Vaultaire safe?

Vaultaire encrypts files with AES-256-GCM and says its backups are encrypted before they leave the phone. The weaker link is the unlock. A drawn pattern has far fewer realistic combinations than its grid suggests, so the strength of a backup protected by PBKDF2 depends heavily on how unusual your pattern is.

What is the difference between Oorvel and Vaultaire?

Vaultaire unlocks with a drawn pattern and can back up to iCloud. Oorvel unlocks with six random words, uses Argon2id instead of PBKDF2, has no network access at all, and is open source.

Does Oorvel have a duress or wipe pattern like Vaultaire?

Oorvel has a decoy vault for the moment someone insists you open it. Exactly what it does, and does not do, is on the security page.

Can I move from Vaultaire to Oorvel?

Save your photos from Vaultaire back to your photo library, import them into Oorvel, then delete them from Photos and empty Recently Deleted.

Sources

1. Vaultaire, home page and pricing (vaultaire.app)
2. Vaultaire, features overview
3. Vaultaire, plausible deniability and recovery phrase
4. Vaultaire, hidden vaults
5. Vaultaire, encrypted iCloud backup
6. Vaultaire, privacy policy (dated September 24, 2026)
7. Photo Vault - Vaultaire on the App Store
8. Aviv et al., Smudge Attacks on Smartphone Touch Screens, USENIX WOOT 2010
9. Uellenbeck et al., Quantifying the Security of Graphical Passwords, ACM CCS 2013

Last checked October 28, 2026. Spotted a mistake? Write to corrections@oorvel.com.