Lockboxy questions, answered plainly

Lockboxy is a private, encrypted vault app for iPhone, published on the App Store as “Lockboxy: Secret Photo Vault”. It keeps photos, videos, files, notes, passwords and bank cards, voice recordings and private contacts behind a passcode of its own. Everything is encrypted with AES-256-GCM on the device; there is no account and no server holding your content. It is built by Đào Văn Thương, an independent developer in Vietnam.

Lockboxy is available now on the App Store for iPhone. The Android version is still in the works and is not yet listed on Google Play, so an Android app with a similar name on Google Play is a different product.

Yes. The free plan has no time limit: it includes the full encryption and security core, unlimited notes, wallet entries and private contacts, and room for up to 30 photos or videos and 10 files. It shows occasional ads, only inside the unlocked vault. Premium (monthly, yearly or a one-time lifetime purchase) removes those limits and the ads; the exact price is always shown in the app before you buy.

No. There is nothing to sign up for. You set a passcode on first launch and the vault exists only on your device.

No. This Lockboxy is a mobile vault app by an independent Vietnamese developer. Lockboxy by Tekvo is an unrelated data-security platform for Notion, and a lockbox in everyday use is a metal key safe. They only share a name.

Your passcode is run through Argon2id to derive a 256-bit master key that exists only in memory while the vault is open and is never written to disk. That key unlocks a random data-encryption key, which encrypts each file in chunks with AES-256-GCM and a fresh nonce. File names and thumbnails are encrypted too, not just the content.

No. Lockboxy has no server for vault content and never receives your passcode. The app uses Firebase Analytics with an anonymous per-install identifier that is never linked to what is in your vault or to who you are. A file only leaves your phone if you send it somewhere yourself, for example by exporting an encrypted backup.

Yes. You choose a separate passcode for the vault, so someone who knows your phone's code still cannot open it. Face ID or Touch ID can be switched on as a shortcut; it simply re-enters your real passcode and is never a way around it.

Each wrong attempt in a row makes the next one wait longer, from 1 second up to 2 minutes. With Premium, Intruder Selfie takes a photo after 4 wrong attempts and the Security Log records every attempt with a timestamp. Nothing captured is uploaded.

No. The vault hides its content from screenshots and from the app-switcher preview automatically.

No, and nobody else can either. The encryption key is derived from your passcode, which is never stored or sent anywhere, so there is no reset and no backdoor. The only sanctioned fallback is a Recovery Key, a Premium feature you have to generate in advance (Settings → Recovery Key) and keep somewhere safe.

Open the vault, go to Media, tap +, pick photos or videos and choose Hide. You can also share photos, videos or files into Lockboxy from Photos, Files or any other app through the Share Sheet (iOS), take pictures with the in-app camera so they never reach the Photos app, or turn on Auto-Hide Screenshots. When you remove the originals from your library, iOS shows its own confirmation first.

Select the items in the vault and tap Unhide. They are decrypted and written back to your Photos library.

Yes, on iOS. Point the camera at a page and Lockboxy finds the edges, straightens it and saves it into Files as one PDF or as images, encrypted like any other file. The suggested title is read from the page on the device only.

Bank cards, passwords, Wi-Fi logins, live two-factor (2FA) codes and crypto recovery phrases. Each field is encrypted individually, and saved passwords can be checked against known breaches.

Yes. The vault works fully offline. A connection is only needed for the private browser and the web shortcuts.

With Premium you can export an encrypted backup file and save it wherever you choose — your own iCloud Drive, Google Drive or Files — check it with Verify Restore without touching your vault, and get an optional weekly, two-weekly or monthly reminder. Premium also includes LAN transfer between your own devices. Without a backup, the vault exists only on that one device, so deleting the app deletes its content.