Is the iPhone Hidden Album Safe?
It is safe from a casual glance, and not much more. The Hidden album keeps photos out of your main library, and Apple locks it behind Face ID or Touch ID. It does not give those photos their own encryption key.
Get an email when Cryptile is on the App Store
What do I need to know?
- It hides photos from view. They leave the main library and move to the Hidden album.
- They are still ordinary photos. Apple does not describe separate encryption for them.
- They travel with your account. With iCloud Photos on, hidden photos are hidden on your other devices too.
What does the Hidden album protect?
Apple says iOS 14 and later can hide the album itself, so it appears nowhere in Photos. With iOS 16 and later, Face ID or Touch ID is required by default.
That covers a friend scrolling through your camera roll. It covers a photo that should not appear in a slideshow or a shared screen.
Where can hidden photos still show up?
- Your other devices. Apple says photos hidden on one device are hidden on the rest, not removed from them.
- A Shared Library. Hiding a shared photo moves it to the Hidden album for every participant, and they can view or unhide it.
- Your iCloud account. Under standard data protection, Apple keeps the keys for Photos and can decrypt them for you.
Advanced Data Protection changes the last point. Apple says it makes Photos end-to-end encrypted. See Apple's iCloud data security page.
When is it enough?
Use the Hidden album for photos that are private but not dangerous. Gift ideas and awkward screenshots are the usual examples.
Use something stronger when the person you worry about may hold your phone, or may get into your account. Our guide on hidden album versus a vault app compares the two.
How does a vault differ?
A vault app keeps files outside the Photos library. Each file is encrypted, and the key comes from something only you know.
Delete the originals after you move photos in. Then empty Recently Deleted, where Apple keeps photos for 30 days.
What this doesn't protect against
No vault helps if someone watches you unlock it or your phone is already compromised. A short pattern is weaker than a passphrase, so use 8 or more cells. If you lose both your pattern and your recovery phrase, the vault is gone.
Do it with Cryptile
Cryptile encrypts every file with AES-256-GCM, using a key derived on your device from a drawn pattern. There is no account and no server, and the developer never holds your keys. A different pattern opens a different vault, with no vault list.
Cryptile is free to start, with encrypted iCloud backup included.