Samsung Secure Folder Explained: What Knox Actually Encrypts
Secure Folder isn't just a hidden app drawer — it's a Knox-encrypted container with its own keys, stored separately from the rest of your Galaxy phone. Here's what that actually protects, the copy-vs-move mistake that undoes it, and where the protection stops.
What It Is: The Short Answer
Secure Folder is a Knox-encrypted space on Samsung Galaxy devices for photos, videos, files, and apps, locked separately from your phone's main screen. Setup takes a minute: Settings > Security and Privacy > More security settings > Secure Folder, sign into a Samsung Account, then choose a PIN, pattern, password, or biometric lock. Here's the part most people miss. Copying a photo into Secure Folder leaves the original sitting unencrypted right where it was. Moving it deletes that original and leaves only the encrypted copy behind. If the goal is actually protecting the file, moving is the only choice that gets rid of the unprotected version.
How It Actually Works
The encryption underneath Secure Folder comes from Samsung Knox, which is embedded at the chip level during manufacturing rather than installed as an app. Knox uses ARM TrustZone to establish a hardware root of trust before the operating system even boots. That's also where Secure Folder's encryption keys actually live — in an execution environment walled off from the main phone processor, not just tucked away in a settings menu. Compare that to Android's built-in Locked Folder, which hides files from the gallery app but doesn't isolate the keys in dedicated hardware the way Knox does. The difference is real.
It's not a flawless system, though. Knox has a documented history of real flaws: a 2014 case where PINs turned up stored in plaintext instead of properly hashed, plus further vulnerabilities reported by outside researchers in 2016 and by Google Project Zero in 2017. Hardware-backed key isolation raises the difficulty of an attack considerably. It doesn't mean the system will never have another flaw.
Why It Matters for Your Privacy
Keeping keys in TrustZone has a simple payoff: malware that compromises the personal side of the phone still can't reach them. Even with the phone's main screen unlocked, Secure Folder's contents stay encrypted and inaccessible until the folder is separately authenticated — a second, independent lock, not a second coat of paint on the same one. Samsung Cloud backup adds a way to recover that content if the device is lost, stolen, or replaced. Convenient, yes, but worth being clear-eyed about: backing up to the cloud means trusting an additional party with that data, not just the phone in your hand. It's the same tradeoff at the heart of what on-device processing actually means, and worth folding into the privacy habits worth building into a routine. Secure Folder is strong protection against a borrowed phone, a repair-shop handoff, or device-level malware. It isn't a defense against someone who already knows how to unlock it.
How Privara Handles This
Privara is built around the same idea Secure Folder is reaching for — a genuinely encrypted vault, not just a hidden one — for iPhone users who don't have a Galaxy device or Knox available to them. It encrypts everything with AES-256 at rest, requires no account, and uploads nothing to a server by default, so it's zero-knowledge by design. One encrypted vault holds your photos, videos, documents, and contacts together, all four in the same place, behind a PIN entered into what looks and works like an ordinary calculator — nothing on your home screen signals the vault exists at all. Break-in detection captures a photo of anyone who enters the wrong PIN, and a decoy PIN opens a separate, second vault if you need one. Turning on iCloud sync is a real change to the threat model, worth knowing going in rather than assuming it either way.
Download Privara on the App Store to keep your photos, videos, documents, and contacts in one genuinely encrypted vault.
Frequently Asked Questions
Does Secure Folder actually encrypt my files, or just hide them from the app list?
It encrypts them. Content moved or added into Secure Folder is stored using Knox's hardware-backed encryption, with the keys held in TrustZone — a separate execution environment isolated from the rest of the phone. That's a real cryptographic barrier, not just a folder a file browser could still open.
What's the difference between copying and moving a file into Secure Folder?
Copying leaves the original file exactly where it was — unencrypted, outside the folder — while a duplicate is encrypted inside Secure Folder. Moving deletes the original from its prior location, so only the encrypted copy remains. Moving is what actually protects the file.
Can malware or a thief get into Secure Folder if they unlock my phone's main screen?
Not through the main lock alone. Secure Folder requires its own separate authentication, and its encryption keys live in TrustZone, isolated from the main Android environment — so software that compromises the personal side of the phone still can't reach those keys.
Is Samsung Knox unbreakable?
No security system is. Knox has held up to defense-grade certification, but it's also had documented issues over the years, including a 2014 case where PINs were found stored in plaintext and further flaws reported by researchers in 2016 and 2017. Hardware-backed encryption meaningfully raises the difficulty of an attack; it isn't a guarantee against every future flaw.
Conclusion
Secure Folder's real protection comes from where Knox stores its keys, not from the fact that it's a second lock screen. The copy-vs-move choice is what actually determines whether a file is protected or just duplicated next to an unprotected original — worth checking the next time you add something to it.