Is a Locked Note in Notes Safe Enough for Private Photos?

Hidlet is an iPhone app

Point your iPhone camera at the code to install. No account needed.

or text me the link

You have a scan of your passport, a photo of a medical letter and a few things you would rather not show a stranger. A friend says: put them in a locked note. It’s built in, it’s free, and it asks for Face ID. Is that actually enough for your situation?

The honest answer is “yes, for some things”, and the “some” matters. This page is about deciding for your own case. For the full feature-by-feature comparison with Hidlet, see Hidlet vs Locked Notes.

What Apple says a locked note protects

When you lock a note, Apple’s security guide says a key is made from your password and the note and all its attachments are encrypted with AES-GCM. For notes in iCloud, locked notes are end-to-end encrypted, and Apple says it doesn’t have access to them. Images, sketches, tables, maps and websites can be locked. That is a real lock around text and pictures.

Check your own situation

Go through these before you trust it with something important:

• Is it a scan or a photo? An image attachment can be locked. A PDF can’t: Apple says you can’t lock notes with PDF, video, audio or file attachments, or notes with tags. A passport or medical letter saved as a PDF has to stay out of Notes.
• Who might open your phone? In Settings → Apps → Notes → Password you choose Use Device Passcode or Use Custom Password. With the device passcode, anyone who knows it can open your locked notes. If that person is the worry, choose a custom password. Hide Photos From Someone Who Knows Your Passcode goes through that case.
• Is your account one Notes can lock? Apple says you can’t lock notes if you’re signed in with a Managed Apple Account, notes that sync with other accounts (such as Gmail or Yahoo), Quick Notes, or notes shared in iCloud.
• Could you forget the password? See the next section.

To lock one note, open it, tap the More button, then tap Lock. Apple says the title of a locked note stays visible in the notes list, so give it a harmless title. The comparison page covers the other limits, including that one unlock opens all your locked notes for a few minutes.

The forgotten-password risk

This is the part to take seriously. If you forget a custom Notes password and can’t use Face ID or Touch ID, Apple says it can’t help you back in. Apple also warns not to rely on Face ID or Touch ID as the only way in, because changing your Face ID or Touch ID settings, or the Notes password, means entering the password again. You can reset the password, but only notes you lock afterwards use the new one.

Apple’s security guide says Notes shows your hint after three wrong tries in a row. Write a hint that means something to you and little to others, and store the password somewhere safe. With Use Device Passcode there is no second password to forget, but the passcode opens everything.

After you add a photo to a note

The original is still in your library until you delete it, and Recently Deleted holds deleted photos for 30 days. Steps are in How to Hide Photos From Someone Who Knows Your Passcode.

When a vault is the better fit

A locked note is a good, free choice for a few images and some text, if you accept a visible title. A vault suits a growing library, videos or files, or a person who knows your passcode. Hidlet is made for that: a pattern you draw opens only its own vault, the app never lists vaults, and a 9-word recovery phrase opens a vault if you forget the pattern. Hidlet is available on the App Store.

What Hidlet can and can’t protect

Hidlet protects what is inside a vault. It won’t replace Notes for text you want on your Mac or iCloud.com, and it can’t protect a copy of a photo you left in your library or in a note. If you lose both the pattern and the recovery phrase, the vault can’t be opened.