The short answer
With the default iCloud settings, yes. If iCloud Photos is on, Apple holds the keys and can technically decrypt your photos, hidden ones included. With Advanced Data Protection on, Apple does not hold the keys.
Hiding a photo in the Photos app adds no protection against Apple.
Default settings: Apple holds the keys
Apple says that under standard data protection, iCloud Photos are encrypted in transit and on its servers. The keys are secured in Apple data centers. That is how Apple can restore your data when you sign in on a new device.
The Hidden album has a lock, but the lock works on your device. It controls who can open the album on that phone. It does not change who holds the keys in iCloud.
Advanced Data Protection: your devices hold the keys
This optional setting moves the keys for most iCloud data, Photos included, to your trusted devices. It comes with costs:
- Apple cannot help you recover this data. You need a recovery contact or a recovery key.
- Web access at iCloud.com is off until you turn it back on, and a trusted device must approve it.
- Shared Albums and “anyone with the link” sharing do not support it.
- Some Photos metadata stays under standard protection. Apple lists whether an item is a favorite, hidden or deleted. It is encrypted, but Apple stores those keys.
To turn it on, open Settings, tap your name, tap iCloud, scroll down, then tap Advanced Data Protection. You need iOS 16.2 or later, two-factor authentication and a device passcode. Your other signed-in devices need current software too.
Look at your iCloud Photos switch first
Open Settings, tap your name, tap iCloud, then tap Photos. If it is on, you can choose Advanced Data Protection, or keep the photo out of iCloud Photos. Are hidden photos saved to iCloud shows how.
What Vault9 does with its iCloud backup
Everything in the vault is encrypted on your phone with AES-256-GCM. The iCloud backup saves the encrypted vault in your own iCloud storage and never contains your Secret Key. The vault opens with your pattern or passphrase and your Secret Key, or Face ID, if you turn it on.
Apple can see that the backup exists, the number of items, their padded sizes, the dates of changes and the model of the active iPhone.
Import does not delete anything in Photos. Until you delete the original yourself, it stays in your library and in iCloud Photos. If you forget your pattern or passphrase, Vault9 cannot reset it. Read it from your Emergency Kit, if you wrote it there.
Sources
- Apple Support: iCloud data security overview (checked 2026-11-06)
- Apple Support: How to turn on Advanced Data Protection for iCloud (checked 2026-11-06)
- Apple Support: Hide photos on your iPhone, iPad, Mac, or Apple Vision Pro with the Hidden album (checked 2026-11-06)
