If you are searching for a Keepsafe alternative, the useful question is which vault app lets you check, at the level of mechanism, how your keys, accounts, backup and sharing work. This page compares weavevault.app with Keepsafe on that question and on four dimensions: encryption and key handling, accounts and network, backup and pricing, and sharing and recovery.
One limit applies to the whole page. We did not have verified facts about Keepsafe, so we make no claim about its pricing, encryption, analytics, accounts, storage, platforms, features or ownership. Where the Keepsafe column would hold a fact, it points you to Keepsafe's own published pages instead. The weavevault.app column is stated precisely, and each line can be checked against our security page and support page.
The wedge is how the key is made. In weavevault.app the unlock pattern is the only credential, it passes through Argon2id, and it is never written to disk. The rest of the page follows from that design.
| Feature | weavevault.app | keepsafe | |
|---|---|---|---|
| Account required | No account of any kind: no email, no profile, no sign-up, on free or Pro | Check Keepsafe's own sign-up flow and privacy policy | Our side is stated on /security and /support. Nothing is asserted about Keepsafe. |
| Encryption mechanism | AES-256-GCM, fresh random 96-bit nonce and 128-bit tag per file; Argon2id (t=3, m=64 MiB, p=1) derives a key-encryption key that wraps a random 256-bit per-vault content key | See Keepsafe's published security documentation | Mechanism as published on /security. Keepsafe's cryptography is not characterised here. |
| Where the unlock secret lives | The pattern is never written to disk, not to a file and not to the Keychain | See Keepsafe's own documentation | We make no claim about what an examiner with the physical device could or could not determine. |
| Analytics and crash reporting | None: no analytics, no crash reporting, no advertising or attribution SDKs | Check Keepsafe's privacy policy for its defaults | Our side is stated on /security. |
| Server-side vault storage | No Weave Vault vault-storage server; encrypted backup copies ciphertext to your own iCloud or Google Drive | Check Keepsafe's own storage and backup documentation | See /features/encrypted-backup for our side. |
| Backup and restore | Enabling backup requires Pro; restoring never does. Nothing is uploaded by default, and the app is excluded from ordinary device backups | Check Keepsafe's pricing and backup pages | The split between enabling and restoring is exact, from /support. |
| Free tier and Pro pricing | Free: up to 3 vaults, up to 50 files per vault. Pro: monthly, annual with 7-day trial, or one-time lifetime | Check Keepsafe's current pricing page | No Keepsafe prices are quoted on this page. |
| Platforms | iPhone and iPad (iOS 16+) and Android; no Windows, Mac or web app | Check Keepsafe's own store listings | A real gap if you need desktop or web access. |
| Recovery | Per-vault 12-word recovery phrase; if the pattern and phrase are both lost, the vault cannot be opened and there is no support override | Check Keepsafe's recovery documentation | From /support and /manifesto. |
Encryption and key handling
Files in weavevault.app are sealed with AES-256-GCM. Each file gets a fresh random 96-bit nonce and a 128-bit authentication tag. Large files are encrypted in independently authenticated chunks, up to 16 GB per file.
The key hierarchy runs in a fixed order. Your unlock pattern goes through Argon2id (RFC 9106, t=3, m=64 MiB, p=1, over a 128-bit salt) to produce a key-encryption key. That key wraps a random 256-bit per-vault content key generated by a CSRNG. The Argon2id output does not encrypt file contents directly. Per-item subkeys are derived with HKDF-SHA256. There is no separate passphrase: the pattern is the only credential.
The pattern is never written to disk, not to a file and not to the Keychain. An unrecognised pattern opens a fresh empty vault rather than showing an error, and the app keeps no vault list, switcher or count. We make no claim about what an examiner with the physical device could or could not determine.
For Keepsafe, see Keepsafe's own published security documentation. This page does not describe or rate its cryptography. For a plain-language primer on how encrypted photo storage works in general, read what a photo vault is and how encrypted storage works.
Accounts, analytics and network
weavevault.app has no account of any kind. There is no email, no profile and no sign-up, on the free tier or on Pro. The only way in is the pattern on your device.
The app contains no analytics, no crash reporting, and no advertising or attribution SDKs. There is also no Weave Vault vault-storage server. Nothing is uploaded by default, and the app is excluded from the phone's ordinary device backup by design, so a routine iCloud or Finder backup of the phone never contains it.
These are statements about weavevault.app only. We did not have verified facts about Keepsafe's sign-up flow, analytics or network behaviour, so check Keepsafe's own sign-up flow and privacy policy for its defaults before you decide. The security page lists the weavevault.app side so you can compare it line by line.
Backup, storage and pricing
The free tier of weavevault.app gives you up to 3 vaults and up to 50 files per vault. Pro is sold as a monthly subscription, an annual subscription with a 7-day trial, or a one-time lifetime purchase. We do not claim unlimited storage, because it is not published anywhere.
Backup follows a split that is easy to get wrong, so here it is exactly. Enabling encrypted backup requires Pro. Restoring never does. Browsing and exporting your own files work without a subscription, including if Pro lapses.
When backup is on, the vault's ciphertext is copied to your own iCloud or Google Drive. No vault key and no plaintext leaves the device, and there is no Weave Vault vault-storage server in between. The details are on the encrypted backup page, and if you want to see how a cloud-backed vault fits together, read the cloud vault guide.
We did not have verified Keepsafe pricing or backup details, so none are quoted here. Check Keepsafe's pricing and backup pages for its current terms.
Sharing and recovery
Sharing in weavevault.app sends a point-in-time copy of a whole vault. The copy is re-keyed from scratch each time, has an enforced expiry, and can be revoked early from Shared vaults in the vault's settings. Recipients do not need a vault of their own and do not need to pay for anything.
Recovery works per vault. Each vault has its own 12-word recovery phrase. If both the pattern and the phrase are lost, the vault cannot be opened: we do not hold a copy, and there is no support process that can override this. That is the cost of having no account and no server that holds your key, and you should decide whether you accept it before you rely on the app.
For how Keepsafe handles sharing and recovery, check Keepsafe's recovery documentation and its own feature pages. If you are comparing vault apps more broadly, our comparison of private photo vault apps covers the general criteria, and the guides for iPhone and Android cover each platform.
Verdict
Pick weavevault.app if you want no account, no analytics and a key derived from a pattern that is never written to disk, and you accept that losing both the pattern and the 12-word phrase means the vault cannot be opened. It fits readers who want to verify the mechanism on a published security page rather than take a promise on trust.
weavevault.app has no Windows, Mac or web app, and the free tier is capped at 50 files per vault. If you need desktop or web access, or more room before paying, it may not fit. This page does not rate Keepsafe, so confirm Keepsafe's current features, pricing and platforms on Keepsafe's own site, and choose it if those match what you need.