Face ID or PIN for a photo vault — which and why

How each lock actually fails, why a good vault uses both, and what to do about the PIN you will eventually forget.

Updated: 2026-08-20

Every vault app asks this on first launch and most people pick whichever is fastest. The two locks fail in genuinely different ways, though, and the sensible answer for a private photo vault is usually both — one for speed, one for recovery.

What Face ID actually is

Face ID doesn't hand your face to the app. It's a system service: the app asks iOS "is this the owner?", the Secure Enclave answers yes or no, and the face data never leaves that chip. Even Apple doesn't have it, and the app certainly doesn't.

Good at: speed, and shoulder-surfing. Nobody learns your face by watching you unlock.

Fails when: the phone is at an angle on a desk, your face is half-covered, it's dark and the phone is far away, or someone holds the phone up to your face. It also can't work at all if the hardware is disabled or the phone is a model without it.

What a PIN actually is

A number you know, checked by the app. On a well-built vault it's not merely compared — it derives the key that decrypts the files, so a wrong PIN doesn't just refuse entry, it produces nothing.

Good at: working everywhere, always. No hardware dependency. And it's separate from your phone passcode, which matters more than it sounds: someone who watched you unlock your phone still can't open the vault.

Fails when: you forget it, or someone watches you type it. A four-digit PIN is 10,000 combinations — fine against a person, meaningless against software, which is why a good vault also rate-limits attempts.

Use both, in this arrangement

The arrangement that actually works day to day:

Face ID as the everyday unlock. Fast, no typing, nothing to observe.
PIN as the fallback, for when Face ID doesn't fire.
Face ID as PIN recovery, so forgetting the number is annoying rather than fatal.

That last one is the piece most apps get wrong. Private Photo Vault uses it deliberately: if you forget the PIN, you can recover it with Face ID without losing a single file. The alternative design — "forgot your PIN, the vault is gone" — is technically defensible and, for a folder of family photos, a catastrophe waiting for a bad week.

Choosing a PIN that isn't the obvious one

Don't reuse your phone passcode. The whole point of a second lock is being different from the first, and someone who knows the phone code will try it here first.

Avoid the top of the list — 1234, 0000, 1111, birth years — which are a large share of all PINs in every study ever run. Avoid dates that appear anywhere on your own social media.

Six digits over four if the app allows it: a hundred times the space for two extra taps.

What neither lock protects against

Being honest about the boundary:

Someone with your phone passcode. On many designs the passcode can reset app-level protection. A vault raises the bar; it doesn't replace device security.
A screenshot you already sent. Locking the original changes nothing about the copy.
Backups you forgot about. If the photos were in iCloud Photos before you moved them, check what synced where.
Being compelled to unlock. Legal rules differ by jurisdiction and biometrics are often treated differently from a memorised code. If that's a real concern for you, that's a question for a lawyer, not an app description.

The practical setup

1. Turn on Face ID for everyday unlocking.

2. Set a PIN that is not your phone passcode, six digits if offered.

3. Confirm PIN recovery exists — and test it once, deliberately, before you need it.

4. Check the vault locks immediately when you leave the app, not after a timeout.

Point 3 is the one people skip. Trigger the recovery flow on purpose while you still remember the PIN. Finding out how it works on the day you've forgotten it is the wrong time to discover there isn't one.

Private Photo Vault