OneDrive Personal Vault is the folder Microsoft puts in front of anyone who already pays for, or simply uses, OneDrive. It sits inside your OneDrive, asks for a second check before it opens, and locks itself again when you walk away. The question people search next is whether it's actually encrypted, and whether that's the same as being private. Here's what Microsoft says, and what it means in practice.
What Personal Vault Does
Microsoft describes Personal Vault as a protected area in OneDrive for your most important or sensitive files and photos. Compared with the rest of your OneDrive, it adds a few things:
- A second check to open it. Signing in to your Microsoft account isn't enough. You also confirm with a fingerprint, your face, a PIN, a code sent by email or SMS, or the Microsoft Authenticator app.
- Automatic locking. Microsoft says it locks after 20 minutes of inactivity on the web and 3 minutes on mobile. On a Windows PC you set the wait time yourself.
- No sharing. Files inside it can't be shared. You move a file out first.
- Fewer traces. Vault items don't show up in OneDrive search, and thumbnails are hidden on your computer.
For keeping a tax return or a passport scan behind one more door than the rest of your cloud files, that's a sensible design.
Is It Encrypted?
Yes, in the way the rest of OneDrive is. Microsoft's support page on how OneDrive protects your data says each file is encrypted at rest with a unique AES-256 key, and that files are protected in transit with TLS. On a Windows PC, Personal Vault files sync to a BitLocker-encrypted area of your drive, and Microsoft says they aren't cached unprotected on your PC, device or browser.
What Microsoft doesn't say is that it's end-to-end encrypted. The same page explains that each file's key is itself encrypted with master keys stored in Azure Key Vault, Microsoft's own key service. So the keys are managed on Microsoft's side, not derived from a password only you know. That's the difference Zero-Knowledge Encryption, Explained walks through: encryption that protects your files from outsiders isn't the same as encryption that keeps the provider out too.
What Opens It
Personal Vault's strength is the extra step. Someone who has your Microsoft password still needs your fingerprint, face, PIN or a code to get in. That's real protection against a leaked password.
It's worth being clear about what that extra step protects against, though. It's an access check in front of files that live in your Microsoft account. Anyone who can pass the check, or who is sitting at your unlocked PC before the vault locks, sees the files. And because the keys sit with Microsoft, the vault is protected by Microsoft's policies, not by a secret only you hold.
The Limits Most People Miss
Microsoft's own FAQ lists several limits worth knowing before you rely on it:
- Three files on the free plan. Without a Microsoft 365 Family or Personal subscription, you can only add up to three files.
- No Mac app. Personal Vault is available from the web, the mobile app or a Windows PC. macOS isn't on the supported list, so on a Mac you use it in the browser.
- File names on Windows 10. Microsoft says Personal Vault on Windows 10 doesn't protect the names or hashes of files when the vault is locked.
- Deleting on a PC. Files deleted from Personal Vault on a PC are permanently deleted and don't go to the PC recycle bin.
- Editing on mobile. You can view Office documents on your phone, but you have to move them out of the vault to edit them.
- Recent lists. A file you open from the vault might still show up in that app's Recent list.
None of these are flaws so much as the shape of the feature: a locked corner of a cloud drive, built mainly for Windows.
The Lock-or-Gate Test
In How to Password Protect a Folder on Mac and Windows we use three questions to judge any locked folder. Here's how Personal Vault answers them:
- Are the files encrypted? Yes: AES-256 at rest, TLS in transit, BitLocker for local copies on Windows. Not end-to-end.
- Is the key separate from your account? Partly. You need a second check, but the vault is part of your Microsoft account and the keys are managed by Microsoft.
- What happens if you forget it? You recover through your Microsoft account and its verification methods. Convenient, and also a sign the key isn't yours alone.
That makes Personal Vault a strong gate in front of cloud storage rather than a lock only you can open. If what you're really after is a replacement, The Best Secure Folder Alternative for Windows and Mac compares the options side by side.
When a Dedicated Vault Is Worth It
A vault app like Vaultine answers those questions differently. Files are encrypted on your device with AES-256 and open only with Vaultine's own pattern or PIN, separate from your Microsoft account, your Mac password or your phone's passcode.
It also covers what Personal Vault doesn't try to:
- A real Mac app. Vaultine runs natively on macOS and Windows, and the same vault works on iPhone and Android too. The Encrypted Vault for All Your Devices shows how.
- Being asked to unlock. A Decoy Vault and a Duress Vault handle the moment when someone insists you open it.
- A forgotten pattern or PIN. A 12-word recovery phrase gets you back in. Nobody else holds your key, so nobody else can.
Your files stay on your device by default. Dropbox sync (Pro) is optional, and if you use it, the files are encrypted before they leave your device. If you'd rather keep using OneDrive, How to Encrypt Files Before Uploading to Dropbox explains the same idea for any cloud drive: encrypt first, then upload.
The Short Version
OneDrive Personal Vault is encrypted: AES-256 at rest, TLS in transit and BitLocker on Windows PCs. It adds a second check, locks itself and blocks sharing. It isn't end-to-end encrypted, the keys are managed by Microsoft, free accounts get three files, and there's no Mac app. If you want a lock with its own key that works the same on your Mac and your PC, that's what a dedicated vault is for.
Try it free with up to 10 files at vaultine.app.
