How to Create an Encrypted Photo Vault on Android Using Termux and VeraCrypt

Keeping personal photos private on a shared or lost Android device can be a real headache. Android’s built‑in file permissions protect apps, but a determined person with physical access can still browse the DCIM folder or any other media directory. An encrypted container gives you a single, password‑protected vault that behaves like a regular folder while it is mounted, and appears as random data when it is not.

Before you start

• Charge your phone to at least 50 % – mounting a container uses CPU and can drain battery quickly.
• Connect to a stable Wi‑Fi network. The VeraCrypt binary is downloaded from the official site; a mobile data download may be large (≈ 10 MB).
• Enable Developer options → USB debugging. This is not strictly required for the tutorial, but it makes it easier to pull logs if something goes wrong.
• Back up any existing photos you plan to move into the vault. While the process is safe, a mis‑typed command could overwrite files.

Step 1 – Install Termux and basic utilities

1. Open the Google Play Store (or F-Droid) and install Termux.
2. Launch Termux. It will display a command prompt like ~ $.
3. Update the package index and upgrade existing packages:

   pkg update && pkg upgrade -y

4. Install the tools needed to download and verify VeraCrypt:

   pkg install wget gnupg openssl -y

Step 2 – Download the VeraCrypt command‑line binary

VeraCrypt provides a pre‑compiled veracrypt binary for Android’s ARM64 and ARMv7 architectures. Choose the one that matches your device.

1. Find out your CPU architecture:

   uname -m

   • aarch64 → ARM64 (most modern phones)
   • armv7l → 32‑bit ARM
2. Download the matching binary (example for ARM64):

   wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7_Android_arm64.tar.bz2

3. Extract the archive:

   tar -xjf VeraCrypt_1.26.7_Android_arm64.tar.bz2

4. Make the executable runnable:

   chmod +x veracrypt

5. Move it to a directory in your PATH for convenience:

   mv veracrypt $PREFIX/bin/

Step 3 – Create an encrypted container file

The container is just a regular file that VeraCrypt will treat as a virtual disk.

1. Decide where you want the vault to live. For simplicity we’ll use the internal storage’s Documents folder:

   cd /storage/emulated/0/Documents

2. Create a 1 GB container (adjust size as needed). The dd command writes zeros to allocate space:

   dd if=/dev/zero of=photo_vault.hc bs=1M count=1024

   • If you get “Permission denied”, run termux-setup-storage first to grant Termux access to shared storage.
3. Initialize the container with VeraCrypt, choosing AES‑256 and a strong passphrase (minimum 12 characters, mixed case, numbers, symbols):

   veracrypt --text --create photo_vault.hc --size 1024M --encryption AES --hash SHA-512 --volume-type normal --filesystem ext4 --password YOUR_STRONG_PASSWORD --pim 0 --keyfiles '' --random-source /dev/urandom

   Replace YOUR_STRONG_PASSWORD with your actual passphrase. The command runs in text mode, so you will see a progress bar.

Step 4 – Mount the container

When the container is mounted, it appears as a regular directory that you can browse with any file manager.

1. Create a mount point (a folder that will host the decrypted view):

   mkdir ~/photo_vault_mount

2. Mount the container:

   veracrypt --text --mount photo_vault.hc ~/photo_vault_mount --password YOUR_STRONG_PASSWORD --pim 0 --keyfiles ''

   If the mount succeeds, ls ~/photo_vault_mount will show an empty directory.

3. Open your favorite Android file manager (e.g., Files by Google) and navigate to /data/data/com.termux/files/home/photo_vault_mount. You can also create a symbolic link for easier access:

   ln -s ~/photo_vault_mount /storage/emulated/0/PhotoVault

   Now the vault shows up as PhotoVault in the shared storage view.

Step 5 – Move photos into the vault

With the container mounted, treat the mount point like any other folder.

1. Open the Android Gallery app, select the photos you want to protect, and use the “Share → Save to Files” option to copy them into PhotoVault.
2. Alternatively, from Termux you can copy files directly:

   cp /storage/emulated/0/DCIM/Camera/*.jpg ~/photo_vault_mount/

3. Verify that the files are present:

   ls ~/photo_vault_mount

Step 6 – Unmount the container when you’re done

Leaving the vault mounted means the decrypted data is accessible to any app that can read the mount point. Always unmount when you finish.

1. From Termux, run:

   veracrypt --text --dismount ~/photo_vault_mount

2. If you receive “Device is busy”, close any file manager tabs that point to the vault and retry.
3. After unmounting, the PhotoVault folder will appear as a regular file (the encrypted container) and its contents will be unreadable without the password.

Step 7 – Automate mounting with a simple script (optional)

Typing the long mount command each time can be tedious. Create a small wrapper script in Termux’s bin directory.

1. Open the editor (Termux includes nano):

   nano $PREFIX/bin/mount_vault

2. Paste the following (replace the password placeholder):

   #!/data/data/com.termux/files/usr/bin/bash
   VOLUME="/storage/emulated/0/Documents/photo_vault.hc"
   MOUNTPOINT="$HOME/photo_vault_mount"
   PASS="YOUR_STRONG_PASSWORD"
   veracrypt --text --mount "$VOLUME" "$MOUNTPOINT" --password "$PASS" --pim 0 --keyfiles ''
   

3. Make it executable:

   chmod +x $PREFIX/bin/mount_vault

4. Now you can simply run mount_vault to mount the vault.

Troubleshooting

1. “Permission denied” when creating the container

• Run termux-setup-storage and grant the permission dialog.
• Ensure the target directory is on the primary shared storage (not an external SD card that may be formatted as exFAT, which VeraCrypt cannot format).

2. Mount fails with “Incorrect password or PIM”

• Double‑check that you typed the exact passphrase; passwords are case‑sensitive.
• If you used special characters, wrap the password in single quotes to prevent shell interpretation.

3. “Device is busy” when dismounting

• Close any file manager windows, gallery apps, or background services that might be scanning the mount point.
• Use lsof +D ~/photo_vault_mount (install lsof via pkg install lsof) to see which process holds the folder.
• Force dismount as a last resort:

  veracrypt --text --dismount --force ~/photo_vault_mount

4. Container size too small

• VeraCrypt cannot enlarge an existing container. Create a new, larger one and copy the contents over:

  veracrypt --text --create larger_vault.hc --size 2048M ...
  veracrypt --text --mount larger_vault.hc ~/temp_mount ...
  cp -r ~/photo_vault_mount/* ~/temp_mount/
  veracrypt --text --dismount ~/temp_mount
  rm photo_vault.hc
  mv larger_vault.hc photo_vault.hc
  

Security considerations

• The container’s security relies entirely on the strength of your passphrase. Use a password manager to generate a random 20‑character string.
• Never store the passphrase in plain text on the device. If you must automate mounting, consider using veracrypt --keyfiles with a file stored on an encrypted SD card.
• When the device is rooted or compromised, an attacker could capture the password in memory. On a non‑rooted device the risk is lower, but still possible if malicious apps gain accessibility permissions.

What to expect after you finish

Once you have followed the steps, you will have a portable .hc file that you can copy to any other Android device (or a PC) that has VeraCrypt installed. Mounting it with the same password will reveal the photos, while the file itself remains unreadable to anyone without the key. This gives you a practical, low‑cost solution for protecting sensitive images without rooting or buying a third‑party vault app.

Enjoy the peace of mind that comes with true encryption, and remember to back up the container file to a secure location (e.g., an encrypted cloud drive) in case your phone is lost or damaged.