The iPhone Hidden album is not hidden. Here is what is.

Open Photos, scroll to Utilities, tap Hidden, glance at Face ID. That is the whole security model of Apple’s Hidden album, and it is fine for what it is: a way to keep an embarrassing screenshot out of the grid you show your aunt.

It is not a way to hide anything from a person who wants to find it.

What the Hidden album actually does

A hidden photo is an ordinary photo with a flag. The file is stored the same way, synced the same way, and backed up the same way. Since iOS 16 the album asks for Face ID before it opens, but:

• Everyone knows the album exists. It is one tap from the Albums tab.
• Your passcode opens it. Anyone you have ever shared your passcode with — a partner, a family member, a repair shop — opens it.
• iCloud Photos shows the same album on your Mac and iPad.
• The word “Hidden” is a signpost.

Locked door vs encrypted file

Most vault apps on the App Store are a PIN screen in front of unencrypted files. That is a locked door: it protects the app, and only while the app is the way in. A backup, a cable and a computer, or a phone left unlocked go around it.

An encrypted file is different. The bytes on disk are useless without a key, and the key comes from something only you know. Hushfold seals every item with AES-256-GCM under a key derived from your master password (PBKDF2-SHA256, 600,000 rounds). Copy the files somewhere else and you have copied noise.

Five questions to ask any vault

1. Does it need an email or account? A privacy tool that starts by asking who you are has already told you something.
2. Is the file encrypted, or just the app locked?
3. What happens when you stop paying? Some vaults hold your own photos behind a subscription.
4. What does the App Store privacy label say? “Usage data collected” in a vault is a contradiction.
5. Can you export everything, for free, today?

Hushfold’s answers: no account; encrypted file; nothing is ever gated; “Data Not Collected”; one-tap export of the whole vault.

Hiding from a person, not a thief

Passcodes fail against someone who can make you type them. For that case there is a second PIN that opens a separate, real vault, and optional disguise screens. Both are off by default and listed in the App Store description — hiding a feature from Apple is not the same as hiding your photos from a person, and we only do the second.