Passcode AEncrypted
A
Vault A
Independent vault identity and encryption key.
Private photo vaults for iPhone
Every vault hasits own way in.
One discreet keypad opens multiple independent encrypted photo vaults. Copy or move photos into a Hollow, then create a portable encrypted .khvault protected by its own separate recovery code.
Submitted to the App Store · Free at launch
Nothing to browse.The locked screen never lists vaults or shows how many exist.
One code. One world.Each passcode resolves only to its own encrypted vault.
Independent by default
A different passcode opens a different world.
KeyHollow does not make you choose a vault from a list. You enter a passcode, and only its matching vault opens.
Passcode BEncrypted
B
Vault B
Separate from every other KeyHollow space.
Passcode CEncrypted
C
Vault C
No visible directory on the locked screen.
Privacy through absence
No vault browser. No vault count. No clue what waits behind the keypad.
KeyHollow's locked state is deliberately quiet. It does not enumerate private spaces, hint at their names, or advertise how many have been created.
01Enter a valid passcode.
02Only its associated vault becomes available.
03Leave the app and KeyHollow locks again.
Copy to Vault
Encrypt a vault copy and keep the original in Photos.
Move to Vault
Encrypt and verify first, then ask iOS to remove the original.
✓Encrypted copy verified before any deletion request
Import with intent
Move without gambling with the original.
Copy and Move are separate, explicit choices. A Move does not begin by deleting—it begins by encrypting and validating the new vault copy.
Need to move a Hollow? Export only the vault that is open as an authenticated .khvault archive. Every export receives a new random 32-character recovery code, kept separate from the vault’s local LowKey. A successful restore creates a new local LowKey.
Security is a product decision
Convenience doesn't get to rewrite the vault boundary.
01Authenticated encryption for photos, thumbnails, vault manifests, and portable .khvault archives.
02Strong 8–20 digit local LowKeys; predictable repeated and sequential patterns are rejected.
03Every export receives a new random 32-character recovery code, separate from the local LowKey.
04Archive metadata and encrypted chunks are authenticated; altered, malformed, or oversized imports are rejected.
05No KeyHollow account, cloud service, advertising, or analytics SDK is required for the secure app path.
06Automated cryptographic regression tests and CodeQL analysis guard security-sensitive changes before release.
Planned future updates
More ways to protect a growing private library.
Upcoming releases are intended to expand what you can protect and make larger private collections easier to manage—while keeping KeyHollow local, focused, and private.
Folders inside each vault
Arrange private photos into clear folders while preserving the independence and encryption boundary of every Hollow.
Photos, videos, and more
Expand beyond today’s photo workflow with secure handling for video and additional file formats.
Open when the moment arrives
Create encrypted collections intended to remain closed until a date or condition you choose.
Future time and location controls
Explore carefully designed access conditions without weakening KeyHollow’s local-first security model.
Roadmap items are under evaluation and may change after security, reliability, and App Store review.
Your private photos stay yours.
KeyHollow is local-first. Vault contents, local LowKeys, export recovery codes, encryption keys, usage history, and device identifiers are not sent to a KeyHollow server.
Privacy note
Selected photos are processed, re-encoded to reduce embedded metadata, encrypted, and stored inside the app's protected container. Deleting the app, a vault, or the device may permanently remove access.
Need help?
Never send a vault passcode, encryption key, or private photo to support. Temporary contact: keyhollow.app.support@gmail.com