Your gallery is a filing cabinet
with no lock.
Start with the phone below — it works. Lock a few files, forget the passphrase on purpose, watch what the app refuses to do for you. It takes two minutes, and nothing is uploaded, installed, or asked of you. Further down you can see what your gallery looks like without any of this.
Use it before you install it.
This is the real interface, running in the page. Pick a few items, choose a strength, set a passphrase, watch the queue encrypt, then open the vault and play something back — including getting the passphrase wrong on purpose.
- Tap a few tiles, then press the green button.
- Choose a strength, set a passphrase, and remember it.
- Open the vault and try the wrong passphrase first.
Your library, before anything happens
Tap a few tiles to queue them. In the app these are your real photos and videos — you can also browse for any file type, or shoot straight into the vault so it never reaches the camera roll.
Simulation only — nothing is encrypted in this page and no files are touched. The Android app does the real work with Argon2id key derivation and 1 MiB authenticated records.
Library
Tap photos and videos to add them to the queue
How to encrypt
—
Times are estimates for your queue on this device. All options use trusted, modern encryption.
Set a passphrase
It locks and unlocks every item in this queue
Encrypting
—
—
All done
—
Originals deletedVault
—
Decrypt video
From your vault
Enter the passphrase used to encrypt it
Playing keeps the video inside NeverLeave — other apps can’t see it, and it locks again when you close the player. Saving to your library makes it a normal video that other apps can see.
Same photos. Two realities.
Shared storage is readable by every app you have granted media access, and the metadata rides along: where a photo was taken, when, and on what. NeverLeave writes ciphertext instead — the media store never indexes it, other apps see an opaque container, and the filename itself is encrypted inside the file.
drag · or use the ← → keys
Six promises you can check.
Not slogans — behaviors, each one visible in the app or in the privacy policy.
Encrypt before write
Files are sealed in 1 MiB authenticated records with a key derived by Argon2id. Nothing is ever written in the clear, and a 10 GB video never loads into memory.
Verify before delete
An original is removed only after the finished ciphertext has been re-read end to end, every authentication tag checked, and the plaintext hash matched. A failed check keeps the original.
Decrypt inside only
Plaintext exists in one place — a private cache the media store never indexes — and is destroyed when the player closes. It leaves only when you save it to your library or share it yourself.
Keep no keys
The passphrase is never persisted in plaintext and never leaves the phone. The app passcode lives as a salted hash in the OS keystore. There is no escrow copy anywhere.
Upload nothing by default
No account, no NeverLeave server. Sync is opt-in, points at a WebDAV server you own, and carries ciphertext only.
Promise no rescue
Lose the passphrase and the files stay sealed permanently. The app says so before it starts, and makes you tick a box.
Pick your cost.
Same container, same verification. The difference is the cipher and how hard the key derivation works your phone.
Quickest option. Solid protection for everyday privacy.
Strong, industry-standard encryption at a reasonable speed.
Hardest to crack. Takes noticeably longer on big videos.
What it never does
- Create an account or ask for your email
- Send files or passphrases to the developer
- Bundle ads, analytics, or crash-reporting SDKs
- Write your passphrase to durable storage
- Keep a recovery key that could open your vault
- Index decrypted files into the gallery behind your back
Straight answers.
What if I forget the passphrase?
The files stay sealed. There is no reset, no recovery key, and no developer override. You can store an optional hint, but it is display-only text and cannot rebuild the passphrase.
Does anything get uploaded?
Only if you turn on WebDAV sync and enter your own server — and then only ciphertext. There is no NeverLeave account and no NeverLeave server to upload to.
Why aren’t vault items in my gallery?
They are .kfv containers in app-private storage, deliberately not indexed as media. You browse them from inside the app.
Only photos and videos?
Any file. “Decrypt & open” hands it to another app through the system share sheet and deletes the temporary copy as soon as sharing finishes.
Ads, analytics, crash reporting?
None bundled. This website loads no third-party scripts, fonts, or trackers either.
Put the lock on the cabinet.
Free, offline, and honest about the one thing it can’t do for you.