“The Lisbon decoy room is the first time plausible deniability actually works on iOS. If compelled to unlock, you draw the decoy pattern and hand over clean travel snapshots with total peace of mind.”
Darkroom
Draw your bolt pattern (6+ bolts)
Vault · Main Room
Your Hidden album isn’t actually hidden. Darkroom is.
Your photos move into a vault only your bolt pattern can open. Encrypted on your iPhone with Argon2id and AES-256-GCM. No account, no sign-up, no email.
Become an Early Tester
Claim your private beta seat. The first 100 early testers receive 1 Month of Free Darkroom Pro during the beta, plus an exclusive 50% discount on subsequent Yearly and Lifetime plans.
You’re on the early tester roster!
We’ve reserved Early Tester Pass #63 of 100 for you@example.com.
TestFlight beta build dropping soon · iOS 17+ · 1 Mo Free Pro + 50% off for first 100 testers · No payment info needed
Darkroom is a local-first encrypted photo, video, and note vault for iPhone and iPad. A pattern drawn across a 5×5 plate of 25 bolts is stretched with Argon2id (64 MiB, 3 passes) and a 256-bit room-header salt to unwrap a random 256-bit vault key, which unwraps a unique AES-256-GCM key for every file and 1 MiB streamable chunk.
Verified Architecture · Private Beta Roster
Battle-tested by privacy advocates, journalists, and photographers.
We believe security software should never demand blind faith. Here is how our DRK1 zero-knowledge architecture is audited, who built it, and what our early private beta testers have to say.
“I manage over 20,000 high-res client RAW frames. Every other vault app lagged or corrupted exports. Darkroom streams 1 MiB chunked AES-GCM without dropping a single frame.”
“Zero accounts, zero servers, zero telemetry SDKs. It feels like software from the golden era of native Apple craft, backed by brutal Argon2id math and hardware Secure Enclave binding.”
Built From One-Star Reviews
Most vault apps either risk data loss or trap your files behind paywalls. Darkroom is built to keep your library recoverable and exportable.
Before writing a single line of Swift, we read thousands of one-star reviews across competing iOS vault apps. Almost nobody complained about missing novelties. They complained about vanished libraries, subscription lockouts, and fake PIN screens. Darkroom was engineered around six non-negotiable rules.
-
Rule 01
Never Lose a Frame
Every migration, interruption, and CloudKit restore is tested against real vaults. Built-in “Check Vault” verifies every file’s GCM tags on demand.
-
Rule 02
Out as Easily as In
Import and export are symmetrical. Batch-export thousands of frames or entire Rolls back to Photos or Files in one tap, with original ProRAW/HEIC bytes and capture dates intact — zero paywalls or accounts required.
-
Rule 03
Backup That Restores
Backups you can actually restore, even if you reinstall the app or switch devices. Backs up only AES-256-GCM ciphertext chunks to your private iCloud; encryption keys never leave your iPhone.
-
Rule 04
No Hostage Pricing
1,000 frames and 1 decoy room free forever with zero ads. If a Pro pass ever lapses, you retain complete lifetime access to view, play, export, and back up everything in your vault.
-
Rule 05
Mathematically Sealed
Encrypted on-device with Argon2id + AES-256-GCM, so your vault stays unreadable without your bolt pattern. Not us, not Apple, and not a forensic dump can access your library.
-
Rule 06
Fast With Huge Libraries
Built to stay fast even with large libraries. Tested on 20,000+ frames on iPhone 15 Pro; 4K HDR videos start playing in under a second thanks to random-access 1 MiB chunked AES buffers.
Zero-Knowledge Feature Architecture
Everything a real vault should do. Nothing it shouldn’t.
We build cryptographic storage architecture, not ad-tech data vacuums. Every frame, filename, capture date, location, thumbnail, and note is sealed before it touches disk.
5×5 Bolt Pattern Lock
Draw a path across at least 6 of 25 bolts — exponentially more combinations than a 3×3 pattern or 4-digit PIN. Argon2id (~64 MiB RAM, 3 passes) slows every offline brute-force guess to ~0.5 seconds.
Passphrase Spare Key
Prefer a long high-entropy phrase, or use VoiceOver? Add a passphrase in Settings › The door. It wraps the same 256-bit vault key in an independent Argon2id envelope so you never get locked out.
Plausible Deniability
Darkroom never displays a list of vaults or a room switcher. Each pattern derives a key that unwraps only its matching room header — a wrong pattern opens nothing and reveals zero other rooms.
Unlisted Decoy Rooms
Set a second bolt pattern that opens a believable room filled with everyday photos. Nothing in Settings marks it as a decoy, and Face ID only ever unlocks your main room so biometrics can’t expose decoys.
Silent Duress Pattern
Under physical coercion? Draw your duress pattern. Darkroom opens an ordinary room while silently destroying the local keys and encrypted files of every other room on that iPhone in milliseconds.
Nested Rolls & Per-Roll Locks
Unlike vaults that dump everything into one flat grid, Darkroom organizes frames into nested Rolls with custom cover frames and colour tags. Pro lets you lock individual Rolls behind their own bolt pattern.
Sealed Private iCloud Backup
On by default and free for every user. Frames, thumbnails, and metadata are encrypted with AES-256-GCM before upload to your private CloudKit database. Apple receives only ciphertext and cannot decrypt a single pixel.
iPhone & iPad Sync + Shared Vaults
Open the same rooms across iPhone and iPad with native keyboard shortcuts and drag-and-drop, or share a sealed vault over CloudKit. Remote deletions go to the Fixer Tray so another device never erases local frames silently.
In-Vault Camera & Blind Share Sheet
Shoot photos and videos straight into the open vault so nothing ever touches your Camera Roll. Or use “Send to Darkroom” from any app — it seals files with a public-key envelope while your vault key stays locked away.
Disguise Icons & Capture Shield
Swap the Home Screen icon for subtle utility alternates or pair with a custom Shortcuts title. Darkroom blanks the iOS app switcher preview and hides vault contents automatically during screen recording.
DRK1 Chunked Streaming & Integrity Check
Videos are encrypted in 1 MiB AES-256-GCM chunks with AAD truncation guards so 4 GB 4K videos play immediately without full-file temp decryption. Run “Check Vault” anytime to verify every file’s authentication tags and repair damaged chunks from iCloud.
Encrypted Notes & 30-Day Fixer Tray
Write private notes with titles and bodies right alongside your photos, autosaved and encrypted in place. Deleted frames rest in the Fixer Tray for 30 days before permanent erasure on-device and in iCloud.
How It Works
Three stages. Then the safelight comes on.
No setup wizards, no account registration, no recovery servers. You draw a bolt pattern, develop your frames, and close the door.
-
01 Stage 01 · The Door
Set Your Bolt Pattern
Draw your path twice across at least 6 bolts on the 5×5 plate. Argon2id stretches your pattern with a 256-bit room-header salt into the wrapping key that unlocks your random 256-bit vault key. Add Face ID for your main room or a passphrase spare key.
-
02 Stage 02 · Developing
Develop Your Frames
Pick photos and videos from Photos or Files, share from any app, or shoot with the in-vault camera. Every item gets its own random 256-bit file key and is sealed into 1 MiB AES-256-GCM chunks before iOS prompts to remove the Camera Roll originals.
-
03 Stage 03 · Sealed Sync
Close the Door & Seal to iCloud
Lock the app or swipe away. Darkroom zeroes active keys in memory, masks the iOS app switcher snapshot, and syncs only encrypted records to your private CloudKit container. New iPhone? Draw your pattern and your vault restores.
Cryptographic Architecture
Keys inside keys. None of them leave your iPhone unwrapped.
Your bolt pattern never encrypts files directly. It derives an Argon2id wrapping key that unlocks your room header, which unwraps a random 256-bit vault key, which unwraps a unique 256-bit key for every individual photo, video, thumbnail, and note.
- Argon2id (64 MiB RAM, 3 passes, 1 lane) resists GPU and ASIC cracking far better than legacy PBKDF2-SHA512 or bare PIN hashes
- AES-256-GCM via Apple CryptoKit authenticates every file chunk, SQLite metadata column, capture timestamp, and thumbnail
- DRK1 1 MiB chunked format binds header magic, chunk index, and final-chunk marker into GCM Additional Authenticated Data (AAD) so reordering or truncation is caught immediately
- Portable room header + Keychain rate-limiter stores the 256-bit Argon2id salt in the room header so you can restore from CloudKit on a new iPhone using only your bolt pattern
- One-way public-key Share Extension lets “Send to Darkroom” encrypt imports into an ephemeral Curve25519 envelope without holding your vault key
// 1. Stretch bolt pattern or passphrase in memory
patternKey = Argon2id(
secret: canonicalBoltPath,
salt: roomHeader.salt256, // 32-byte per-room random salt
memory: 64_MiB, passes: 3
)
// 2. Unwrap the room's master key (1 header per room)
vaultKey = AES_256_GCM.open(roomHeader.sealedKey, using: patternKey)
// Wrong pattern? GCM tag fails -> 0 rooms revealed
// 3. Unwrap per-frame key & stream 1 MiB chunks
fileKey = AES_256_GCM.open(frameMeta, using: vaultKey)
chunk[i] = AES_256_GCM.open(
ciphertextChunk[i],
key: fileKey,
nonce: baseNonce ^ counter(i),
aad: "DRK1" || uint32(i) || isLastChunk
)
// Change pattern? Only roomHeader.sealedKey is re-wrapped.
What Darkroom Protects Against
Someone taking your unlocked iPhone, demanding you open the app (use a Decoy Room or the Duress Pattern), inspecting your filesystem, or obtaining a copy of your iCloud data. Without your bolt pattern or passphrase, every file and metadata record is authenticated cryptographic noise.
What It Doesn’t (Honest Threat Model)
A 6-bolt geometric pattern has less entropy than a long random passphrase, and someone who watches your fingers draw it can replay the path. Face ID opens your main room, so if someone could force your face to the phone, disable Face ID and rely on a long passphrase + Decoy/Duress rooms.
Real-World Coercion Defense
Someone takes your phone and asks you to unlock it. Now what?
Most vault apps prove you have something to hide. A locked folder list invites more pressure, and a fake “calculator” disguise fools nobody who knows the App Store. Darkroom gives you three distinct doors on the exact same 5×5 bolt plate — with zero UI clues that other doors exist.
Main Room
Opens your real contact sheet, nested Rolls, and encrypted notes. Optionally paired with Face ID for instant daily access when you are alone.
Decoy Room
Opens a complete, lived-in vault with benign holiday photos and notes. Nothing in Settings labels it a decoy, and there is no vault list anywhere in the UI.
Duress Pattern
Opens a harmless room while silently erasing the local keys and encrypted files of your other rooms on this iPhone. Your sealed iCloud backup remains intact if you choose.
Darkroom vs. The Rest
How Darkroom Compares Across 17 iOS Photo Vaults
Most “photo vault” apps on the App Store merely put a 4-digit PIN screen in front of unencrypted files, force you to create an account on their servers, or cap free users at 20 to 100 photos. See the full 17-point architectural breakdown below.
| Capability / Specification |
|
|
|
|
Calculator# / Privault
|
Vaultaire / Obscura
|
|---|---|---|---|---|---|---|
| Per-file AES-256-GCM encryption Unique random 256-bit key per photo, video & note | ✓ Yes (DRK1 chunked) | ✗ No (OS lock only) | ~ Server-held / opaque | ✗ No (PIN gate only) | ✗ No (unencrypted files) | ✓ Yes (AES-256-GCM) |
| Memory-hard key derivation (KDF) Defends against GPU/ASIC offline brute-force | ✓ Argon2id (64 MiB, 3 passes) | ✗ Same iPhone passcode | ✗ 4–6 digit PIN | ✗ 4-digit PIN | ✗ Calculator PIN | ~ PBKDF2-HMAC-SHA512 |
| 5×5 Bolt Pattern Lock (not a PIN) High-permutation geometric key derivation | ✓ 25-bolt plate (6+ bolts) | ✗ Face ID / Passcode | ✗ PIN pad | ~ 3×3 dot pattern / PIN | ✗ Calculator buttons | ✓ 5×5 pattern grid |
| Passphrase spare key & VoiceOver Independent Argon2id recovery envelope | ✓ User passphrase + VoiceOver | ✗ None | ~ Email reset via server | ~ Email reset | ✗ Security question | ~ 9-word phrase (no VoiceOver lock) |
| Unlisted Decoy Rooms (Plausible Deniability) Zero room picker; wrong pattern reveals 0 rooms | ✓ Free (1 decoy) · Pro (Unlimited) | ✗ Single visible album | ~ Paid “Secret Door” only | ~ Paid decoy password | ✗ Single gallery | ✓ Pattern-separated vaults |
| Duress Pattern (Silent Local Wipe) Opens harmless room & destroys other local rooms | ✓ Yes (Pro) | ✗ No | ✗ No | ✗ No | ✗ No | ✓ Yes |
| Decoy-Safe Biometrics Face ID strictly optional & never reveals decoy rooms | ✓ Main room only (or off) | ✗ Opens everything | ✗ Account-wide | ✗ App-wide | ✗ App-wide | ✓ Pattern-only |
| End-to-End Encrypted iCloud Backup Ciphertext-only in your private CloudKit database | ✓ Free + Pro (on by default) | ~ Standard iCloud Photos | ✗ Keepsafe proprietary cloud | ✗ Paid proprietary cloud | ✗ Unencrypted or paid | ✓ Encrypted CloudKit |
| Nested Folders (Rolls) & Per-Folder Pattern Deep organization with cover frames & roll locks | ✓ Nested Rolls + Roll Patterns | ✗ Flat album only | ~ Flat albums | ~ Flat albums | ~ Basic folders | ✗ No folders supported |
| Full-Quality HEIC, ProRAW & Live Photos Zero recompression by default; dates preserved | ✓ Exact original bytes always | ✓ Original bytes | ✗ Compresses on free tier | ✗ Strips metadata / Live Photo | ✗ Recompresses media | ~ Optimized by default |
| Streamable 4 GB Video (1 MiB AES-GCM Chunks) Plays in <1s without decrypting whole file to disk | ✓ Instant chunked streaming | ✓ Native iOS player | ✗ Slow full-file buffering | ✗ Unencrypted local file | ✗ Unencrypted local file | ~ Whole-file decrypt |
| On-Device Integrity Checker & iCloud Repair Verifies every GCM authentication tag on demand | ✓ Built-in “Check Vault” tool | ✗ None | ✗ None | ✗ None | ✗ None | ✗ None |
| 30-Day Encrypted Fixer Tray (Trash Recovery) One-tap restore for accidentally deleted frames | ✓ 30-day encrypted tray | ✓ Recently Deleted (unencrypted) | ~ Paid trash recovery | ~ Paid trash recovery | ✗ Immediate or unencrypted | ✗ Immediate deletion |
| Free Tier Capacity Usable for real libraries without paying | ✓ 1,000 frames + 1 decoy + iCloud | ✓ Unlimited (device/iCloud) | ✗ ~200 items, nagging trials | ✗ Ad-walled, no cloud | ✗ Ad-walled | ~ 100 photos + 10 videos |
| No Account or Email Required Works out of the box with zero identity linkage | ✓ Never asks for email | ✓ Built into iOS | ✗ Mandatory email signup | ✓ No account | ✓ No account | ✓ No account |
| Zero Ads & Zero Analytics SDKs No ad networks, no PostHog/Firebase telemetry | ✓ 0 ads · 0 analytics SDKs | ✓ No ads | ✗ Ads + tracking SDKs | ✗ Heavy full-screen ads | ✗ Banner & video ads | ~ No ads (analytics on by default) |
| Lapsed Subscription Guarantee What happens to your photos if you cancel Pro | ✓ Full view, export & backup forever | ✓ N/A | ✗ Locks cloud & nags to pay | ✗ Restricts premium albums | ✗ Paywalls export features | ✓ Keeps existing files accessible |
17 Head-to-Head Breakdowns
Every Major iOS Vault App, Audited
Darkroom vs Obscura
VS 01Real on-device AES-256-GCM, no account. However, Obscura offers no recovery key, no vault sharing, and only 1 vault on the free tier.
Darkroom vs Encamera
VS 02Auditable encrypted vault with no account required, but it does not name its underlying cipher spec or publish transparent pricing tiers upfront.
Darkroom vs Inner Gallery
VS 03ChaCha-encrypted vault with a panic PIN. Strong on-device cryptography, but charges $99.99 for a lifetime unlock without a 5×5 bolt plate.
Darkroom vs HiddenVault
VS 04Free hider with a browser and password vault. Uses PIN access and stores files in standard Apple folders with no named cryptographic cipher.
Darkroom vs Apple Hidden Album
VS 05Free and built in, but it hides rather than encrypts—unlocking with the exact same iPhone passcode or Face ID that a coercer already has.
Darkroom vs Private Photo Vault
VS 06PIN protection over unencrypted files sitting in the app container. No duress mode, no 25-bolt pattern lock, and ad-supported on free.
Darkroom vs Keepsafe
VS 07Requires mandatory email account creation, uploads files to Keepsafe’s own servers, and bombards free users with tracking and paywalls.
Darkroom vs Privault
VS 08Calculator disguise UI with PIN-based access, without true per-file authenticated encryption, unlisted decoy rooms, or duress protection.
Darkroom vs SPV
VS 09Simple photo vault with a PIN gate. No zero-knowledge key hierarchy, no plausible deniability, and no tamper-evident integrity checker.
Darkroom vs Secret Photo Album
VS 10Basic album hiding behind a passcode screen. Files sit unencrypted on disk inside the app container, readable by any filesystem extractor.
Darkroom vs PV Secret Photo Album
VS 11Another PIN-protected gallery with heavy ad prompts, no per-file encryption, no cryptographic vault separation, and no duress wipe.
Darkroom vs Calculator#
VS 12Disguised as a calculator app. Clever UI trick on the surface, but media files remain unencrypted underneath if the device is inspected.
Darkroom vs Secret Photo Vault
VS 13Standard passcode lock on a photo album. No true authenticated encryption, no passphrase spare key, and no encrypted vault sharing.
Darkroom vs Hide it Pro
VS 14Legacy multi-purpose hiding app built around obscurity rather than modern Apple CryptoKit primitives or streamable 4K video encryption.
Darkroom vs Safe Lock
VS 15PIN-locked photo vault with paid cloud backup, lacking individual file encryption, ProRAW/Live Photo byte preservation, and duress rooms.
Darkroom vs Vaulty
VS 16Cloud-backed hidden gallery with server-resettable access. Convenient recovery, but not true zero-knowledge user-held encryption keys.
Darkroom vs Vaultaire
VS 17Vaultaire pioneered pattern-locked vaults with PBKDF2, but caps free users at 100 photos and 10 videos, has no folders, optimizes media by default, and enables analytics by default.
Honest Pricing
Every limit, shown before you download.
No ads in either plan. Free iCloud backup and restore in both plans. And if a Pro subscription ever ends, you keep 100% access to view, play, export, and back up everything already in your vault.
Darkroom Free
Free Forever€0
10× larger free library than competing encrypted vaults.
- Up to 1,000 photos & videos + unlimited encrypted notes
- Main room + 1 unlisted decoy room (separate 5×5 bolt patterns)
- Sealed private iCloud backup & restore included free
- Passphrase spare key & optional Face ID for main room
- Nested Rolls with cover frames & colour tags
- Full-quality batch export (HEIC, ProRAW, Live Photos)
- 30-day Fixer Tray & “Check Vault” integrity verifier
- No ads, no accounts, no trackers — ever
Darkroom Pro
Family Sharing Included€2.99 / mo · €19.99 / yr · €39.99 lifetime
One purchase unlocks Pro for your entire Apple Family Group.
- Unlimited photos, 4K videos & notes across all rooms
- Unlimited unlisted decoy rooms
- Silent Duress Pattern (opens harmless room, wipes other local rooms)
- Encrypted sync between iPhone & iPad via CloudKit
- Separate bolt pattern per Roll (lock folders inside a room)
- Encrypted Shared Vaults with other Darkroom users
- Disguise App Icons & custom Home Screen shortcut support
- No-Hostage Guarantee: cancel anytime and keep full access to existing frames
FAQ
Questions, answered plainly.
01What is Darkroom and how does it work?
Darkroom is a native iPhone and iPad app that locks photos, videos, and notes inside encrypted vaults opened by drawing a pattern on a 5×5 plate of 25 bolts. Your pattern is stretched in memory with Argon2id (~64 MiB, 3 passes) and a 256-bit room-header salt to unwrap your 256-bit vault key, which in turn unwraps a unique AES-256-GCM key for every file. Different patterns open different rooms with no visible room list.
02What if I forget my bolt pattern?
Nobody can reset it — not us, and not Apple. That is what makes your vault genuinely private. However, you can add a passphrase spare key in Settings › The door (which also supports VoiceOver). Your passphrase wraps the exact same vault key in a second Argon2id envelope so you always have a spare way in. If you forget both your bolt pattern and your passphrase, the encrypted data cannot be recovered.
03Can you or Apple see my photos in iCloud?
No. Every photo, video chunk, thumbnail, note, and metadata field is encrypted on your iPhone with AES-256-GCM before it is uploaded to your private CloudKit database. iCloud only ever receives opaque ciphertext and random record IDs. Neither Apple nor we ever hold your pattern or unwrapped keys.
04Do I need an account or email address?
No. Darkroom works out of the box with zero sign-up, zero email address, and zero servers operated by us. Encrypted backups automatically use your existing Apple Account’s private CloudKit storage.
05Do you compress my photos or strip ProRAW / Live Photos?
Never. Unlike vaults that recompress images by default, Darkroom always stores your exact original bytes — including HEIC, Apple ProRAW, Live Photos, and 4K video. Capture dates, original filenames, and locations are encrypted inside the vault index and restored intact when you export.
06What happens when I get a new iPhone?
Sign into the same Apple Account on your new iPhone, install Darkroom, and draw your bolt pattern on the Restore screen. Your contact sheet thumbnails appear first so you can browse immediately while full-resolution originals download in the background. Any decoy rooms remain hidden in iCloud until you draw their respective patterns.
07Do you support folders and albums?
Yes — we call them Rolls. You can create Rolls, nest Rolls inside Rolls as deep as you like, pick cover frames, and assign colour tags. With Darkroom Pro, you can also assign a separate bolt pattern to individual Rolls.
08Can Face ID expose my decoy rooms?
No. Face ID is optional and is strictly bound to your main room only. Decoy rooms and the duress pattern always require drawing their bolt pattern on the plate, so a Face ID prompt can never betray that other rooms exist.
09What happens if my Pro subscription ends?
You keep full access to view, play, export, and back up every single frame already in your vault forever. We never lock your existing photos behind a paywall. Only Pro-only features and importing new items past the 1,000-frame free tier pause.
10How do I get my photos back out of Darkroom?
Select as many frames as you want — or an entire Roll — and tap Export › Save to Photos or Save to Files. Your originals export in one batch with their full quality and original capture dates preserved.
11Are there any ads, analytics, or crash trackers?
Zero ad SDKs and zero third-party analytics SDKs (no Firebase, no PostHog, no Amplitude). Optional crash diagnostics are off unless you explicitly opt in, and never include vault keys or media content.
Door Closed · Safelight Ready
Close the door
on prying eyes.
1,000 frames and 1 decoy room free forever. Encrypted on your iPhone, sealed to your private iCloud.
Claim TestFlight Early Pass