Can You Hide Photos in the Notes App? (vs a Photo Vault)

Yes, you can hide photos in the Notes app, and the encryption behind a locked note is genuinely strong. But Notes was built for notes, not for guarding a private photo library, so the method has real limits. Locking works; it just leaves gaps a purpose-built vault is designed to close.

Can you hide photos in the Notes app?

You can, and it’s a popular trick for good reason: it’s built in, free, and the lock is real security, not a flimsy hide-from-view toggle. You add a photo to a note, lock the note, and its contents are encrypted. Anyone opening Notes sees the note exists but can’t read it without your unlock method. For occasionally stashing a sensitive screenshot or two, that’s a reasonable thing to do.

Where it goes wrong is when people assume “locked” means “handled.” Notes gives you a strong lock on a container that was never designed to be a photo vault, and the difference shows up in the practical details: what happens to the original, who can open the note, and whether the fact that you’re hiding something is visible at all. Those gaps aren’t about weak encryption; they’re about using a note-taking app for a job it wasn’t built for.

So the honest version is: hiding photos in Notes is fine for a little, risky if you lean on it for a lot, and worth understanding precisely before you trust it. The rest of this walks through exactly what the lock does protect, where the method leaks, and when a dedicated vault is the better fit.

How locking a note actually protects a photo

Give Notes its due, because the cryptography is solid. When you lock a note, the note and its attachments, including any photos, are encrypted with AES-GCM, a standard, well-regarded cipher. The key is derived from your note password using PBKDF2 with SHA-256, a key-stretching step that makes guessing the password by brute force slow and expensive. This is real encryption, the same class of building block a serious security tool uses.

It also holds up in the cloud. A locked note stays end-to-end encrypted when it syncs to iCloud, meaning the encryption happens on your device before anything leaves it, and Apple can’t read a locked note’s contents even on their own servers. That’s a genuinely strong property, and it’s true whether or not you’ve turned on Advanced Data Protection. If your only worry is whether the photo inside a locked note is encrypted well, the answer is that it is.

So none of what follows is a claim that Notes is insecure. The lock is trustworthy. The problem is everything around the lock, the parts of hiding a photo that a note-taking app was simply never designed to handle.

Where the Notes method falls short for photos

The limits are practical, not cryptographic, and they stack up fast once you’re hiding more than a stray image. A note is a document, not a photo manager, and it shows:

• No real photo management. There’s no gallery, no albums, no easy way to browse or organize. A few images in a note is manageable; fifty is a mess.
• The lock is visible. A locked note appears in your notes list marked as locked. Anyone glancing at Notes can see you’re hiding something, even if they can’t open it. There’s no way to make the private content itself invisible.
• One unlock, often your passcode. Notes can be unlocked with your device passcode, so anyone who knows that passcode, a partner, a family member, someone who watched you type it, can open your locked notes along with everything else.
• It still lives in iCloud. Even encrypted, the note syncs off your device to Apple’s servers. That’s fine for many people, but if your goal is to keep sensitive photos entirely off any server, Notes doesn’t do that.

None of these make the encryption weaker. They make the method leaky in ways that matter for genuinely private photos, which is exactly the territory a dedicated vault is built for.

The gap most people miss: the original stays behind

Here’s the mistake that undoes the whole exercise. When you add a photo to a note, Notes copies it in. The original does not move; it stays right where it was in your Photos library. Lock the note, feel safe, and the unprotected original is still sitting in your camera roll for anyone who opens Photos.

It’s usually worse than a single stray copy, too. The original may also be in a shared album, in your recently added photos, and, if you do delete it, in Recently Deleted for 30 days where it’s trivially recoverable. So the real work of hiding a photo isn’t locking the note; it’s finding and clearing every copy of the original afterward. Skip that and the locked note is security theater, a strong lock on a copy while the real photo sits in the open.

To be fair, this isn’t unique to Notes. A dedicated vault has the same requirement: importing a photo doesn’t erase the original, so you delete it yourself. We walk through doing that cleanly in how to hide photos on iPhone. The difference is that a vault is built around that import-and-remove flow and reminds you to finish it, while Notes makes it feel like you’ve moved the photo when you’ve really only copied it.

Notes vs a dedicated vault, side by side

Both use strong encryption, so the real comparison is about design: what each tool is built to do. Here’s how the two stack up on the things that matter for private photos.

Factor	Locked note	Dedicated photo vault
Encryption	AES-GCM, PBKDF2-derived key	AES-256-GCM, Argon2id-derived key
Built for photos	No, it’s a note	Yes, gallery and albums
Where data lives	Syncs to iCloud (encrypted)	On device, no server (varies by app)
Unlock	Device passcode or note password	Separate PIN, independent of passcode
Hides that content exists	No, locked note is visible	Often yes, some offer a decoy
Delete original yourself	Yes	Yes

The pattern is clear: the encryption is comparable, but a vault is shaped around private photos while a note is shaped around text. The Argon2id versus PBKDF2 difference is real but modest, both are legitimate key-stretching functions, with Argon2id being the more modern, memory-hard choice. The bigger gaps are the ones design drives: management, where the data lives, how it’s unlocked, and whether anyone can see you’re hiding something at all.

When Notes is genuinely enough

It would be dishonest to tell you to never use Notes for this. For the right situation, it’s perfectly reasonable, and reaching for a separate app would be overkill. Notes fits when you have a small number of sensitive images, you touch them rarely, and you’re willing to do the cleanup.

Concretely, it’s a fine choice if you’re hiding one or two documents, a photographed form, a screenshot with a password, and you’ll delete the originals and clear Recently Deleted afterward. You get real encryption for zero setup, and the downsides, no gallery, a visible lock, passcode-based unlock, mostly don’t bite when there’s little to manage and you’re not worried about someone knowing a locked note exists. For light, occasional hiding, the built-in lock does the job.

The calculus shifts when the photos become a collection, or when the stakes rise, when it would genuinely matter if the wrong person opened them. That’s where the note’s limits stop being minor and a purpose-built tool earns its place.

When a dedicated vault makes sense

Once you’re protecting an actual set of private photos, the design differences start to matter more than the shared strong encryption. A dedicated vault is built for exactly this: it gives you a gallery to manage many images instead of scrolling a note, and it treats the photos as the point rather than as attachments.

The security model can also go further than a note’s. A vault can keep everything on your device with no server at all, so nothing syncs anywhere, which some people prefer over even encrypted iCloud. It can use a separate PIN, so knowing your device passcode isn’t enough to open it, closing the gap where a locked note falls to whoever knows your passcode. And some vaults offer a decoy, a second vault that opens under a different code, for situations where you might be pressured to unlock, which we get into in iOS App Lock vs a photo vault. None of that makes a locked note insecure; it makes a vault a better-fitting tool when the photos really are private.

Where Arca fits

Arca is a dedicated on-device vault built around these differences. Each photo is encrypted with AES-256-GCM using a key derived from your PIN through Argon2id, and it lives in the app’s own container with no server and no account, so your photos never sync anywhere the way a locked note does. It’s built to manage a real collection rather than a handful of attachments, and its PIN is separate from your device passcode, so your passcode alone won’t open it. For situations where you might be forced to unlock, it also offers a decoy vault; the model is laid out on our security page. How that on-device encryption actually works is covered in how photo vault encryption works.

To be straight about the limits, since that’s the whole point of an honest comparison: a vault protects only what you put in it, so you still have to delete the originals from Photos and clear Recently Deleted, exactly as you would with the Notes method. And because Arca keeps nothing on a server, it can’t recover your photos if you forget your PIN or lose your device, so it isn’t a backup; keep a separate copy of anything irreplaceable. Use a locked note for the occasional stray image, and a dedicated vault when private photos become something you actually need to manage and keep off any server.

Get Arca on the App Store to keep your private photos in a vault built for them, encrypted on your device with no server and a PIN of their own.