How to Test a Vault App Yourself on a Mac
To test a vault app on a Mac, import a dummy file that holds a unique marker text. Then search your Mac for that marker and the file name: in the app's own folders, in temporary folders, in Spotlight and in Time Machine. A readable copy outside the vault means the app leaves plaintext behind.
Mac steps use macOS 14 and later names. Menu wording can differ slightly between versions.
What this test can and cannot show
The test looks for readable copies of a file in the places an app often leaves them. It does not measure encryption strength. Only a code review or an independent audit can do that. Use dummy files for the whole test. Never start with your real photos.
Run the test
-
Make a test file
Create a text file with a marker nobody else has. The first command creates the file. Every command after it only reads.
echo "VAULTTEST-4f9a2c71-marker" > ~/Desktop/vaulttest-4f9a2c71.txt -
Find the app's identifier
Sandboxed apps keep data in a folder named after this identifier. Replace the path with your app.
APP="/Applications/YourVault.app" ID=$(mdls -raw -name kMDItemCFBundleIdentifier "$APP") echo "$ID" -
Import it, then remove the original
Drag the file into the vault. Delete it from the Desktop and empty the Trash. The only copy should now be inside the vault.
-
Open it inside the vault
View the file in the app for a few seconds. Any temporary copy or preview is made at this moment, so the searches below can find it.
-
Search the app's folders
Search contents for the marker, then file names. macOS may ask whether Terminal can access data from other apps. Allow it for this test. No output means no match.
grep -rl "VAULTTEST-4f9a2c71" "$HOME/Library/Containers/$ID" 2>/dev/null grep -rl "VAULTTEST-4f9a2c71" "$HOME/Library/Application Support/YourVault" "$HOME/Library/Caches/$ID" 2>/dev/null find "$HOME/Library/Containers/$ID" -iname "*vaulttest*" 2>/dev/null -
Search temporary folders
Apps sometimes write a readable copy here while you view a file.
grep -rl "VAULTTEST-4f9a2c71" "$TMPDIR" /private/tmp 2>/dev/null -
Ask Spotlight
Wait a minute, then run both commands. Any result is a readable copy in a place Spotlight indexes. Type the marker into Spotlight (⌘Space) too. Folders on the Search Privacy list (System Settings > Spotlight > Search Privacy) are skipped, so a clean result proves little for a folder you excluded.
mdfind "VAULTTEST-4f9a2c71" mdfind -name vaulttest-4f9a2c71 -
Check previews and recent lists
In Finder, open the app's data folder, select a few files and press Space for Quick Look. Readable content means plaintext. Then look in the Apple menu under Recent Items, if your version has it, and in the app's File > Open Recent, for your test file name.
-
Check Time Machine
See the Time Machine section below. It takes a backup and a look at the timeline.
-
Lock the vault and search again
Lock it, or quit the app, then repeat the temporary-folder and Spotlight searches. Results that remain after the lock matter more than results that vanish when it locks.
-
Test recovery on a throwaway vault
Make a second vault with dummy files. Use its recovery option to get back in before you trust the app with real files. See forgot vault password.
Time Machine: what to look for
Time Machine backs up the vault app's data like other files, so readable files in the app's data folders (step 5) are normally in the backup too. The other thing to check is your original.
- Run a backup after you import the file.
- Enter Time Machine by searching for it in Spotlight, then browse to the Desktop and step back through the timeline. Apple describes this in its restore steps.
- Older backups will still hold the test file, because it sat on your Desktop. That is your original, not the app.
- A backup made after you deleted it should not show it. Apple says local snapshots are hourly and kept for up to 24 hours or until disk space is needed, so they can hold it for a while.
- Apple's older help says you can remove a file from old backups with the Action menu and Delete All Backups of. That works only on an external backup disk, not on local snapshots on your internal drive. The menu may differ on your macOS version.
Read the results
| Finding | What it means | What to do |
|---|---|---|
| Marker found in a file under the app's folders | The app stores a readable copy | Do not put private files in it |
| Marker found in a temp folder after viewing | A temporary readable copy exists while you view | Check whether it stays after you lock. If it stays, treat it as a leak |
| File name found in the app's folders | Names are not hidden | Decide whether names matter for your files |
| Result from Spotlight | A readable copy sits in an indexed place | Find the path and see which app wrote it |
| Nothing found anywhere | No readable copy in these places | Good sign only. It is not proof of strong encryption |
What the test cannot show
- How strong the encryption is, or how keys are made. Open code that others can read helps here. See open source.
- Whether the app sends data over the network. An online photo vault, which keeps files on a server, raises questions this test cannot see.
- What happens if malware runs on your Mac, or someone watches your screen while the vault is open.
- How the app behaves on a different macOS version.
Run the download safety checks before the test, and read what a vault app is for the wider checklist.
Frequently asked questions
Do I need to know Terminal?
You need to paste commands. The first creates a small text file on your Desktop. The rest only read files.
Why use a text file with a marker?
The search tool can find readable text inside any file. If the vault encrypts the file, the marker will not appear in the vault's files.
Does a clean result mean the vault is secure?
No. It means the test found no readable copy in these places. It says nothing about how strong the encryption is.
Can I run this test on an iPhone or Android phone?
No. These commands are for a Mac, and you cannot read app storage on a phone this way.
What if the app is from the App Store?
The same test works. Sandboxed apps keep data in a folder under Library/Containers, and other apps often use Application Support. The steps check both.
Will the test change my files?
No, apart from the test file it creates. Use dummy files only, and delete the test file afterwards.
References
Your files. Your Mac. Locked.
Coming soon. Join the waitlist and we email the link.
Get early access