# iPhone photo backup encryption: who can read your backup

> iCloud backups are encrypted, but the key holder differs. See what Apple says about standard iCloud protection, Advanced Data Protection and computer backups.

Source: https://vault9app.com/guides/iphone-photo-backup-encryption/
Updated: 2026-11-12

Your backups are encrypted, but that does not mean that only you hold the keys. With standard iCloud settings, Apple holds the keys for iCloud Photos and iCloud Backup. With Advanced Data Protection, only your trusted devices hold them. A backup on your computer is not encrypted unless you ask for it.

## iCloud with standard protection

This is the default. Apple encrypts your iCloud data in transit and at rest, and the keys are in Apple data centers. So Apple can decrypt your data when you sign in on a new device, restore a backup, or recover from a forgotten password.

Both iCloud Photos and iCloud Backup fall under this.

## iCloud with Advanced Data Protection

You have to turn this on yourself. Then iCloud Backup, Photos, Notes and more become end-to-end encrypted, and your trusted devices hold the keys. If you lose access to your account, Apple cannot recover this data for you.

To turn it on, open **Settings**, tap your name, tap **iCloud**, scroll down and tap **Advanced Data Protection**. The setup asks for a recovery contact or a recovery key first. Every Apple device on the account must run updated software.

A few details stay under standard protection even then. [The full list of limits](https://vault9app.com/guides/icloud-photos-encryption/) is in our guide to iCloud Photos.

## A backup on your computer

Apple says a computer backup is not encrypted by default. Select **Encrypt local backup** and choose a password to change that. Write the password down. If you forget it, you cannot use your earlier encrypted backups.

## Where the Vault9 vault fits

The vault is not in any of these. Vault9 keeps it out of your iPhone backup, whether that backup goes to iCloud or to a computer.

Vault9 encrypts photos on the iPhone before it stores them, and its own iCloud backup never contains the Secret Key. Vault9 never deletes the originals in Photos, so that step is yours. [Vault9 on the App Store](https://apps.apple.com/app/id6830759639?pt=129716075&ct=iphone-photo-backup-encryption-md)

That backup is the only copy of the vault outside your iPhone, and it lives in your own iCloud storage. Apple can see that it exists, the number of items, their padded sizes and the dates of changes. To open it on a new iPhone, you need the Secret Key from your Emergency Kit and your pattern or passphrase. The Secret Key stays in the iPhone Keychain, set to "this device only", so it does not travel with an iPhone backup.

The steps are in [moving your vault to a new iPhone](https://vault9app.com/guides/transfer-photo-vault-to-new-iphone/).

## Sources

- [Apple Support: iCloud data security overview](https://support.apple.com/en-us/102651) (checked 2026-11-06)
- [Apple Support: How to turn on Advanced Data Protection for iCloud](https://support.apple.com/en-us/108756) (checked 2026-11-06)
- [Apple Support: About encrypted backups on your iPhone, iPad, or iPod touch](https://support.apple.com/en-us/108353) (checked 2026-11-06)