How to hide files, documents and photos on iPhone

Most people hand their phone to somebody else more often than they think. A child who wants to watch something. A colleague you are showing a photo to who keeps scrolling. A friend looking up a restaurant. Someone at home who knows your passcode because of course they do.

None of that is sinister. It is just the normal life of a device that holds your passport scan, your bank statements, your medical letters and eleven years of photographs.

This is what iOS already lets you hide, where it runs out, and how to set up something that survives the moment somebody is standing next to you.

Start with what iOS gives you free

Do these first. They cost nothing and they cover the casual case well.

Photos: the Hidden album

Select a photo, tap the share button, choose Hide. It moves to a Hidden album at the bottom of the Albums tab, which is itself locked behind Face ID.

Good: it comes out of your main library, out of Memories, and out of search results. If someone swipes through your camera roll, it is not there.

Notes: lock individual notes

Open a note, tap the three dots, choose Lock. You can use Face ID or a separate password.

This is genuinely useful for the things people actually keep in Notes: account details, door codes, the list of everything in the safe.

Files: there is no lock

Worth stating plainly because people look for it and then assume they missed it. iOS has no built-in way to password-protect a folder in the Files app. You can lock individual notes and hide photos, but a PDF sitting in Files is open to anyone holding the unlocked phone.

That gap is the main reason document-heavy people end up looking for an app at all.

Where the built-in options stop

Three limits, and they all show up in the same situation.

They all fall back to your device passcode. Face ID is the front door, but the passcode works too. Anyone who knows your passcode, which in most households is at least one other person, can open the Hidden album and unlock your locked notes.

The Hidden album is a famous place. It is not a secret location. Anyone who has used an iPhone in the last few years knows it exists and knows exactly where to tap.

They do nothing when you are present. If somebody asks you to open something, you open it. Hiding assumes the other person is browsing unsupervised and does not know to ask.

The situations this actually comes up in

Not dramatic ones. Ordinary ones.

• Handing the phone to a child so they can watch something, and they wander into Photos
• A partner, flatmate or family member who knows your passcode, as most do
• A colleague or client looking at your screen while you scroll to find the right file
• Leaving the phone on a desk at work, in a classroom, or in a shared office
• Cleaners, repairs, a phone left at a shop, a device lent to someone for an afternoon
• Anyone at all who picks it up while it is unlocked, which is the most common of the lot

In every one of these, what you want is not a secret folder. It is for the sensitive material to not be in the places people look, and for the places people look to have something reasonable in them.

How Vessum handles it

Vessum is a vault that holds photographs, documents and notes behind a passcode of its own. Two things make it different from a folder with a lock on it.

The passcode is not your device passcode. It is separate, it is not stored anywhere, and knowing how to unlock the phone does not help with it.

There is more than one. Each passcode you create opens a different space with different contents. That is the part that matters, and it is the part that takes a little thought.

The space you keep

Make this one first. Put in the things that would actually be a problem in someone else's hands:

• Passport, ID card and driving licence scans
• Bank statements, tax documents, payslips
• Medical letters and test results
• Signed contracts, NDAs, anything work-confidential
• Recovery codes, account details, the note with everything important in it
• Personal photographs you would not want casually scrolled past

Then write the passcode down somewhere physical, away from the phone. It cannot be recovered by anyone, including us.

The space you hand over

Here is the part people get wrong, and the reason this post exists.

If somebody knows you use a vault app and asks you to open it, you open it. The question is what they find. And what they find needs to look like a real person's private things, because that is what stops the conversation.

What goes in a convincing decoy

Personal, but not compromising. Those two words are the whole brief.

The material should be things you genuinely would not want shared around, so it reads as real, while costing you nothing if it is seen.

That last row is the one that makes it work. A vault containing only shopping lists is obviously not a vault. A vault containing an old payslip and some holiday photographs is a person who is a bit private about money and a bit private about their face, which is almost everyone.

Two rules of thumb

Volume beats quality. Twelve items look real. Three look staged. It does not matter that the twelve are unremarkable.

Dates should vary. Twelve things added within the same minute look like what they are. Add some over a few days, or pick older photographs with older dates on them.

A worked example

Someone who keeps work documents on their phone might end up with:

Space one, the one they keep. Passport scan, two bank statements, a signed client contract under NDA, the note with their account recovery codes, eight personal photographs.

Space two, the one they hand over. Nineteen holiday photographs from two different trips, a photo of their dog, four food pictures, a gym membership PDF, last year's car insurance, a shopping list, a note of the home wifi password, a dentist appointment reminder, and one old payslip.

If someone opens the second one, they have found a private person's private things. There is nothing there to push on.

Going further, if you need to

Every space in Vessum can create spaces of its own, and the settings screen is identical in every one. A space lists the spaces it created and never the space it came from.

The practical effect is that somebody who opens a space cannot tell whether they are at the first one you made or three levels down. Most people do not need this. It exists for people preparing for more than one kind of conversation.

The reasoning behind that design, and why most apps offering a second password fail at exactly this point, is in decoy passwords and why most of them do not work.

What this does not do

Three honest limits.

It does not hide other apps. No iOS app can, and anything claiming otherwise is misleading you. We wrote about why in why no app can hide your apps on iPhone.

It does not hide that it is installed. Anyone looking at your phone can see Vessum there and see that it holds encrypted data. What stays hidden is how many spaces exist and what is in them.

It is not a defence against a laboratory. It is built for a person holding your phone, not for forensic extraction by people with the right equipment. If that is your situation, the honest advice is in crossing a border with your phone, and it mostly amounts to not carrying the data.

The short version

1. Turn on the free things first. Hidden album for photos, locked notes for notes.
2. Accept that both open with your device passcode, which other people know.
3. Move the material that would genuinely be a problem into a vault with its own passcode.
4. Build a second space and fill it with twelve or more real, ordinary, slightly personal things.
5. Write both passcodes down somewhere that is not the phone.

Step four is the one everybody skips, and it is the one that decides whether any of this works.

If you want the click by click version, the decoy, and the decoy inside it walks through all three spaces, including which passwords are safe to leave in a decoy.