Vault apps. The calculator that isn't one.
A vault app looks like something ordinary — a calculator, a clock, a weather widget — and opens a hidden gallery when a code is entered. They're in both app stores, they're free, and they're specifically marketed for hiding things from parents.
How they work
Most follow one of three patterns:
- Decoy apps. A functional calculator. Enter a specific sequence and a hidden gallery opens.
- Openly named vaults — "Photo Vault," "Private Space" — PIN-protected but not disguised.
- Built-in OS features. iOS Hidden album, Samsung Secure Folder, Xiaomi's Second Space. No third-party app required.
Several also include a decoy vault: one PIN opens innocuous content, a second opens the real one. That feature exists specifically to survive a parent asking to see inside.
Spotting one
Duplicate or odd utility apps
Two calculators is the classic. Any duplicated utility — two clocks, two notes apps, an audio manager nobody uses — is worth opening.
Check the app store's purchase history
- iPhone: App Store → profile → Purchased shows everything ever downloaded on the Apple ID, including deleted apps.
- Android: Play Store → profile → Manage apps & device → Manage → filter to Not installed.
This is the most reliable check available, because it survives deletion.
Check storage
Settings → General → iPhone Storage (iOS) or Settings → Storage (Android). An app using far more space than its function suggests — a 3GB calculator — is storing something.
Check the built-in hiding places
- iOS: Photos → Utilities → Hidden album. Also check Settings → Photos → whether Hidden Album is set to show.
- iOS App Library: apps removed from the Home Screen still exist there. Swipe left past the last page.
- Android: Settings → Apps → See all apps, which shows apps hidden from the launcher. Also check for Secure Folder or Second Space.
Know when a new app appears
Defenras alerts you to newly installed apps and blocks vault apps as a category — before they've been used for a month.
Get Defenras free →Preventing them
- Restrict installation. iOS: Screen Time → Content & Privacy Restrictions → Installing Apps → Don't Allow. Android: Family Link approval, or Defenras new-app alerts.
- Turn off sideloading on Android.
- Disable multiple user profiles and Secure Folder / Second Space on manufacturer builds.
- Category-block vault apps, since they rebrand as often as any other category.
The harder part: what it means
Finding a vault app feels like catching something. Before acting on that feeling, it's worth separating two possibilities.
Ordinary privacy. A teenager hiding photos from a sibling who goes through their phone, or messages from a parent who reads them. This is what a locked diary was, and the appropriate response is closer to "nothing" than to a confrontation.
Actual concern. Hiding sexual images — of themselves or others. Hiding contact with an adult. Hiding evidence of something happening to them. Hiding self-harm content.
You usually can't tell which from the app's presence alone. Which means the opening move is a conversation, not an accusation.
Of your own child: stay calm — this is far more common than parents realise and the reaction determines whether they tell you the rest. Find out whether it was shared, and with whom. If it was shared, use takeitdown.ncmec.org. Then work out whether coercion was involved, because that changes the situation entirely.
Of another minor: this is legally serious regardless of how it arrived. Don't forward it, don't email it to yourself, don't delete it before getting advice. Consider legal advice before speaking to the school or police, and take the position seriously even if your child received it unsolicited.
The framing that works
Rather than "why do you have a hidden folder," which produces a defensive answer and nothing else, try naming the distinction directly:
"I know you have private stuff and I'm not trying to read your messages. What I need to know is whether there's anything on your phone that someone pressured you into, or that involves an adult. That's the only part I need. If there is, we deal with it together and you're not in trouble."
That draws the line where it actually matters — between privacy, which they're entitled to, and coercion, which they need help with.
Frequently asked questions
How do I know if a calculator app is a vault?
Two calculators is the tell. Also check the app's storage usage — a calculator using gigabytes is storing photos, not sums.
Can I see what's inside a vault app?
Not without the PIN. Some have decoy PINs that open innocuous content specifically to survive being asked. This is a conversation, not a technical problem.
Should I delete a vault app I find?
Deleting it usually destroys the contents, including anything you might need if there's a safeguarding issue. Talk first, delete after you know what you're dealing with.
Is having a vault app automatically bad?
No. Plenty of teenagers use them for entirely ordinary privacy from siblings. What's inside matters; the app's presence on its own tells you very little.
Defenras blocks all of this — without collecting your child's data.
One app, every device, every browser. Adult content, gambling, vaping, scams, malware, social media — all blocked. PIN-locked. Free version available, no credit card.