Can Someone See My Photos If They Know My Passcode?
If they hold your iPhone and know your passcode, assume they can open your photos. Apple's extra checks cover other things, such as saved passwords. A vault with its own pattern keeps chosen photos out of reach even then.
What do I need to know?
- The passcode is the main key to the phone. Whoever holds both can unlock and use it.
- Apple's extra checks target high-risk actions. Photos are not on the list Apple publishes for Stolen Device Protection.
- A vault pattern is a second, separate key. Cryptile derives its keys from the pattern, not from your passcode.
Does Stolen Device Protection hide my photos?
Not by itself. Apple says it adds a layer when your iPhone is away from familiar places, such as home or work. It needs iOS 17.3 or later.
For some actions Apple requires Face ID or Touch ID with no passcode fallback. These include viewing saved passwords and credit cards and turning off Lost Mode. Other changes wait one hour, such as changing your Apple Account password or your passcode.
Turn it on under Settings, Face ID & Passcode. Read Apple's Stolen Device Protection page for the full list.
Does the Hidden album need more than my passcode?
It asks for Face ID or Touch ID by default on iOS 16, iPadOS 16.1 or later. The same goes for Recently Deleted. Apple's Hidden album page describes the setting.
Apple's page does not say what happens if the person also knows your passcode. Do not rely on the Hidden album as protection from someone who has both the phone and the code. Apple does not describe separate encryption for hidden photos.
How does a vault change this?
Cryptile keeps each file as AES-256-GCM ciphertext. The key is derived on your device from a drawn pattern. Your passcode does not unlock it.
A different pattern opens a different vault, and there is no vault list. Someone with your phone and passcode sees only what the pattern they know opens. Plus adds a panic pattern. Drawing it destroys this phone's vault keys, so nothing opens until a vault is restored from its recovery phrase.
What should I do today?
- Change a passcode that others know. Settings, Face ID & Passcode.
- Move sensitive photos into a vault. Then delete the originals, including from Recently Deleted.
- Pick a pattern of 8 or more cells. Cryptile asks for at least 6 and recommends 8 or more.
What this doesn't protect against
A vault cannot help while it is open and someone is watching. Anyone who sees you draw the pattern can copy it. A pattern is weaker than a passphrase, so use 8 or more cells. If you lose the pattern and your 9-word recovery phrase, the vault is gone.
Do it with Cryptile
Cryptile has no account and no server, and the developer never holds your keys. Photos you move in are encrypted on the device.
Cryptile is free for up to 3 vaults, 100 photos and 10 videos in total. Plus removes the limits and adds the panic pattern and search inside the vault. It costs $19.99 a year (7-day free trial), $39.99 once, or $1.99 a week.
Cryptile Send, Files-app access, shared vaults and sync are coming and are not available yet.