---
title: "Is iCloud Encrypted? Yes, but Apple May Hold the Keys (2026)"
description: "Yes, iCloud is encrypted, but by default Apple holds the keys to your photos and backups. What Advanced Data Protection changes, and what it doesn't."
url: https://www.vaultforyou.app/blog/is-icloud-encrypted
lang: en
published: 2026-10-29
updated: 2026-10-29
author: "VaultForYou Editorial Team"
publisher: VaultForYou
---

# Is iCloud encrypted? Standard vs. Advanced Data Protection

> Everything in iCloud is encrypted, but by default Apple keeps the keys to your photos, backups and files, and only you can change that.

Published 2026-10-29 - Updated 2026-10-29 - By VaultForYou Editorial Team

## Quick answer

Yes. All iCloud data is encrypted in transit and on Apple's servers. With standard data protection (the default), Apple holds the keys for most data, including Photos and iCloud Backup; 15 categories such as passwords and Health are end-to-end encrypted. Advanced Data Protection raises that to 25 categories, so only your devices hold the keys.

- **Default:** Standard data protection: encrypted, but Apple holds the keys for Photos, Backup, iCloud Drive and Notes.
- **Always end-to-end:** 15 categories, including passwords and Keychain, Health, Messages in iCloud and Wi-Fi passwords.
- **Advanced Data Protection:** Opt-in. 25 categories end-to-end, including Photos and iCloud Backup. Needs a recovery contact or key.
- **Never end-to-end:** iCloud Mail, Contacts, Calendars, Shared Albums and "anyone with the link" shares.

Yes, iCloud is encrypted: Apple encrypts your data in transit and stores it encrypted on its servers. But by default Apple also keeps the keys for most of it, including your photos, your iCloud Backup, iCloud Drive and Notes, so Apple can decrypt that data on your behalf. Only 15 categories, such as passwords and Health data, are end-to-end encrypted out of the box. Turn on Advanced Data Protection and that rises to 25, with Photos and backups among them. Encrypted isn't the same as private from Apple; who holds the keys decides that.

We checked this against Apple's iCloud data security overview and Platform Security guide in October 2026.

## Is iCloud encrypted? Two levels of protection

Apple offers two settings, and every account uses one of them:

- **Standard data protection** is the default. Your iCloud data is encrypted in transit and at rest, and the encryption keys from your devices are secured in Apple data centers. That lets Apple decrypt your data for you when you sign in on a new device, restore a backup or recover from a forgotten password. A set of 15 sensitive categories is end-to-end encrypted anyway.
- **Advanced Data Protection** is optional. Your trusted devices keep sole access to the keys for most of your iCloud data. Apple says no one else can access end-to-end encrypted data, not even Apple, and that it stays secure even if the cloud is breached.

Both start from your Apple Account. All new accounts require two-factor authentication, which is also required for end-to-end encryption.

## If it's your photos you're worried about: encrypt them before iCloud

Standard data protection leaves your iCloud Photos with Apple-held keys, and even Advanced Data Protection keeps some photo metadata, including whether a photo is hidden, under standard protection. If specific photos shouldn't be in iCloud Photos at all, keep them out of the Photos library.

VaultForYou stores the photos, videos and documents you choose outside the Photos library, so they're not in iCloud Photos. Files are encrypted on your iPhone, the keys stay in the iOS Keychain, and we never see your pattern or your files. The iCloud backup is optional (Premium) and encrypts each file before it goes to your iCloud. Delete the originals and empty Recently Deleted after importing.

> **Encrypt private photos before they reach iCloud.** A pattern-locked vault on your iPhone. No account needed. [Download on the App Store](https://apps.apple.com/app/vaultforyou/id0000000000)

## What's end-to-end encrypted in iCloud?

This is the part most answers skip. Here's Apple's own breakdown for the categories most people care about:

| Data | Standard data protection | Advanced Data Protection |
|---|---|---|
| Photos | Encrypted, Apple holds keys | **End-to-end** |
| iCloud Backup (device and Messages backup) | Encrypted, Apple holds keys | **End-to-end** |
| iCloud Drive | Encrypted, Apple holds keys | **End-to-end** |
| Notes, Reminders, Voice Memos | Encrypted, Apple holds keys | **End-to-end** |
| Safari Bookmarks, Shortcuts, Wallet passes, Freeform | Encrypted, Apple holds keys | **End-to-end** |
| Passwords and Keychain, Wi-Fi passwords | **End-to-end** | **End-to-end** |
| Health, Journal and Home data | **End-to-end** | **End-to-end** |
| Messages in iCloud | **End-to-end** (see note) | **End-to-end** |
| Payment information, Apple Card transactions | **End-to-end** | **End-to-end** |
| Maps, Safari history, Screen Time, Siri information | **End-to-end** | **End-to-end** |
| iCloud Mail, Contacts, Calendars | Encrypted, Apple holds keys | Encrypted, Apple holds keys |

The Messages note: under standard data protection, if iCloud Backup is on, your backup includes a copy of the Messages in iCloud key, so Apple can help you recover. With Advanced Data Protection, that key is end-to-end encrypted inside the backup too. Our guide to [iPhone backup encryption](/blog/iphone-backup-encryption) covers the backup side.

## Are iCloud Photos encrypted?

Yes, always, but the key holder changes with your setting. With standard data protection, Photos is encrypted in transit and on the server with keys stored by Apple. With Advanced Data Protection, Photos is end-to-end encrypted and only your trusted devices can decrypt it.

Even then, Apple keeps some photo metadata under standard protection. For Photos, that includes:

- The raw byte checksum of each photo or video
- Whether an item is marked as a favorite, **hidden** or deleted
- When it was created on the device, imported and modified
- How many times it has been viewed

Apple says this metadata is always encrypted, with the keys stored by Apple, and is used for things like de-duplicating storage without access to the photos themselves. In short, the picture is protected; the fact that you hid it isn't end-to-end encrypted. For what that means in practice, see [can Apple see your photos?](/blog/can-apple-see-your-photos)

## Who can see your iCloud data?

| Who | Standard data protection | Advanced Data Protection |
|---|---|---|
| Apple | **Can decrypt** most data, including Photos and Backup; not the 15 end-to-end categories | **Can't decrypt** the 25 end-to-end categories; can still decrypt Mail, Contacts, Calendars and listed metadata |
| Someone who signs in to your Apple Account | **Yes**, on a device or at iCloud.com | Web access is off by default; turning it on needs approval from one of your trusted devices |
| An attacker who breaches Apple's cloud | End-to-end categories stay protected | Apple says end-to-end data stays secure in a cloud breach |
| People in your Shared Albums | **Yes**, Shared Albums aren't end-to-end | **Yes**, Shared Albums don't support Advanced Data Protection |
| iCloud Shared Photo Library participants | **Yes**, they're participants | **Yes**; end-to-end only if every participant has it on |
| Anyone with an "anyone with the link" share | **Yes** | **Yes**, link shares aren't end-to-end |

The pattern: encryption decides what Apple can read. It doesn't decide what you've shared, or what someone signed in to your account can see. For shared photos, see [iPhone shared album privacy](/blog/iphone-shared-album-privacy).

## What Advanced Data Protection doesn't cover

Turning it on is a real upgrade, but it isn't everything:

- **iCloud Mail, Contacts and Calendars** stay under standard protection because they interoperate with global email, CalDAV and CardDAV systems.
- **Metadata** such as file and photo checksums, modification dates and some backup details (device name, model, serial number, app list, snapshot dates and sizes) keeps Apple-held keys.
- **Shared Albums, iWork collaboration and "anyone with the link" sharing** don't support it. Their keys are uploaded to Apple so sharing works.
- **iCloud.com.** Web access turns off automatically. If you turn it back on, your trusted device approves temporary access, and for the next hour it hands over keys for the categories you open, with a notification each time.
- **Third-party app data** is always encrypted in transit and on the server. Advanced Data Protection makes it end-to-end only when it's stored in iCloud Backup or in CloudKit encrypted fields and assets.

## How to turn on Advanced Data Protection

You need two-factor authentication, a passcode on your devices, and at least one recovery contact or recovery key (a 28-character code). Managed Apple Accounts and child accounts aren't eligible.

1. **Update your devices** Update every device signed in to your Apple Account: iOS 16.2 or later on iPhone, iPadOS 16.2 on iPad, macOS 13.1 on Mac, plus supported versions on any Apple Watch, Apple TV, HomePod or iCloud for Windows signed in to your account.
2. **Open iCloud settings** Open Settings, tap your name, then tap iCloud.
3. **Start Advanced Data Protection** Scroll down, tap Advanced Data Protection, then tap Turn on Advanced Data Protection.
4. **Set up a recovery method** Follow the onscreen steps to add at least one recovery contact or a recovery key. Apple won't be able to recover your data for you after this.
5. **Confirm and finish** Review your recovery methods and turn it on. It applies to your whole account and all compatible devices, and iCloud.com data access turns off automatically.

On a Mac: **Apple menu -> System Settings -> [your name] -> iCloud -> Advanced Data Protection -> Turn On**. You can turn it off any time; your device uploads the keys to Apple again and your account returns to standard data protection.

## Should you turn on Advanced Data Protection?

**Standard data protection is enough** if your priority is never losing access. Apple can help you recover photos, backups and documents after a forgotten password, and the most sensitive categories (passwords, Health, Messages in iCloud) are already end-to-end encrypted.

**Turn on Advanced Data Protection** if you want your photos, backups, files and notes readable only on your devices, and you will reliably keep a recovery contact or recovery key. If those fail, Apple can't recover your end-to-end encrypted data.

**You need more than either** when the issue is people, not Apple: someone with your passcode, a shared Apple Account, or a Shared Library. Encryption in the cloud doesn't stop those; a separate lock on the iPhone does.

## Is Advanced Data Protection available everywhere?

No. Apple says it can no longer offer Advanced Data Protection to new users in the United Kingdom. UK users without it keep standard data protection for the 10 categories it would cover, including iCloud Backup, iCloud Drive, Photos and Notes. The 15 default end-to-end categories aren't affected, and Apple says it remains available everywhere else.

## Frequently asked questions

### Is iCloud encrypted?

Yes. Apple encrypts all iCloud data in transit and stores it encrypted on its servers. The question is who holds the keys. With standard data protection, Apple holds them for most data, including Photos and iCloud Backup. With Advanced Data Protection, your trusted devices hold the keys for most of your iCloud data, and Apple can't decrypt it.

### Is iCloud end-to-end encrypted?

Partly by default, mostly with Advanced Data Protection. Under standard data protection, 15 categories are end-to-end encrypted, including passwords and Keychain, Health data, Messages in iCloud, payment information and Wi-Fi passwords. Turning on Advanced Data Protection raises that to 25 categories, adding iCloud Backup, iCloud Drive, Photos, Notes, Reminders and more.

### Are iCloud Photos encrypted?

Yes, but by default Apple holds the keys. With standard data protection, iCloud Photos is encrypted in transit and on the server with keys stored by Apple. With Advanced Data Protection, Photos is end-to-end encrypted and only your trusted devices hold the keys. Some photo metadata, like checksums, dates and whether a photo is hidden or a favorite, stays under standard protection.

### Can Apple see my iCloud data?

For data that's end-to-end encrypted, no: Apple says no one else can access it, not even Apple. For everything else, Apple stores the encryption keys and can decrypt your data on your behalf, for example when you restore a backup or recover your account. Advanced Data Protection moves most categories into the end-to-end group.

### Should I turn on Advanced Data Protection?

Turn it on if you want photos, backups, files and notes readable only on your own devices and you're confident you'll keep a recovery method. The trade-off: Apple can't help you recover that data if you lose access, iCloud.com access is off by default, and every signed-in device must run supported software. Shared Albums still aren't covered.

### What isn't covered by Advanced Data Protection?

iCloud Mail, Contacts and Calendars stay under standard protection because they work with global email and calendar standards. Shared Albums in Photos, iWork collaboration and "anyone with the link" shares aren't end-to-end encrypted. Some metadata, such as file checksums and dates, also keeps Apple-held keys even with Advanced Data Protection on.

### Is Advanced Data Protection available in the UK?

Not for new users. Apple says it can no longer offer Advanced Data Protection to new users in the United Kingdom, so UK users without it keep standard data protection for the 10 categories it would cover, including iCloud Backup, Photos and Notes. The 15 categories that are end-to-end encrypted by default stay protected. It remains available elsewhere.

## Bottom line

iCloud is encrypted, but "encrypted" and "only you can read it" aren't the same. By default Apple holds the keys to your photos, backups, files and notes, which is what lets it help you recover them. Advanced Data Protection moves those into end-to-end encryption, as long as you keep a recovery method, and it still leaves Mail, Contacts, Calendars, Shared Albums and some metadata outside.

For photos that shouldn't be in iCloud Photos at all, encrypt them on your iPhone in a separate vault and delete the originals.

Keep reading:

- [Can Apple see your photos?](/blog/can-apple-see-your-photos)
- [What is zero-knowledge encryption?](/blog/zero-knowledge-encryption)
- [Is your iPhone backup encrypted?](/blog/iphone-backup-encryption)

## Sources

- [Apple Support: iCloud data security overview](https://support.apple.com/en-us/102651)
- [Apple Support: How to turn on Advanced Data Protection for iCloud](https://support.apple.com/en-us/108756)
- [Apple Platform Security: Advanced Data Protection for iCloud](https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web)
- [Apple Support: Manage web access to your iCloud data](https://support.apple.com/en-us/102630)
- [Apple Support: Apple can no longer offer Advanced Data Protection in the United Kingdom to new users](https://support.apple.com/en-us/122234)

## Keep reading

- [Can Apple See Your Photos? Hidden Photos, iCloud and the Keys](https://www.vaultforyou.app/blog/can-apple-see-your-photos): Apple says it doesn't access photos on your iPhone, but by default it holds the keys to iCloud Photos. What Advanced Data Protection and hiding really change.
- [Is Your iPhone Backup Encrypted? How to Check and Turn It On](https://www.vaultforyou.app/blog/iphone-backup-encryption): iCloud backups are always encrypted; iPhone backups on a Mac or PC aren't by default. How to check, encrypt your iPhone backup, and the password catch.
- [What Is Zero-Knowledge Encryption? A Plain-English Guide (2026)](https://www.vaultforyou.app/blog/zero-knowledge-encryption): Zero-knowledge encryption means only you hold the keys, so the company storing your data can't read it. How it works, what it misses, and how to check an app.
- [How to Hide Photos on iPhone: Hidden Album Guide (2026)](https://www.vaultforyou.app/blog/hide-photos-on-iphone): Hide photos on iPhone in seconds, find your hidden photos in the Hidden album, and see who can still open them, what syncs to iCloud and when a vault is better.

---

Our guides are written and fact-checked by the VaultForYou team against Apple's own documentation. We make VaultForYou, a private vault app for iPhone. Download on the App Store: https://apps.apple.com/app/vaultforyou/id0000000000