iCloud Keychain or a vault: what goes where
What iCloud Keychain keeps
Apple says iCloud Keychain keeps your passwords and other secure information, including passkeys and credit card details, up to date across your devices. The Passwords app, in iOS 18 and later, shows account passwords and passkeys, Wi-Fi passwords and verification codes in one place. It can also warn you about weak, reused or leaked passwords.
Apple says to make sure two-factor authentication is on for your Apple Account before you turn it on. It also lists passwords in iCloud Keychain among the categories that are end-to-end encrypted by default, so Apple doesn't hold the keys.
One thing to know: with Stolen Device Protection on, using saved passwords or passkeys away from familiar places needs Face ID or Touch ID, with no passcode fallback. Here's how that works. Without it, your passcode may be enough to use them, so guard it. That's our advice.
What a vault is for
A vault keeps things that aren't sign-ins: a photo of your passport, a scanned tax form, a medical paper, a private note. It gives them their own lock, separate from your iPhone passcode. Keychain doesn't do this. Apple's Passwords page doesn't list photos, documents or notes among the things it keeps.
What goes where
| What you have | Where it fits |
|---|---|
| Website and app passwords, passkeys | iCloud Keychain (Passwords app). It fills them in for you. |
| Two-step verification codes | The Passwords app can set up and store them. See backup codes for the spare ones. |
| Wi-Fi passwords | iCloud Keychain, rather than a picture of the router. |
| Pictures of an ID, passport or medical paper | A vault with its own lock, or delete them if you don't need them. |
| Scanned documents | A vault, or a folder in Files if a vault is too much. |
| A crypto recovery phrase | Neither. Paper, kept offline. |
| FirstHour's own recovery phrase | Paper. Never a screenshot or a note on the same phone. |
What neither can do
- A Vault note isn't a password manager. You can write a password in a note, but it won't fill it into a sign-in form.
- Keychain doesn't hide a document. It isn't built to hold your passport scan.
- Both depend on a code. Keychain leans on your passcode and Apple Account. A vault depends on its own code, and on a recovery phrase you keep.
How FirstHour helps
FirstHour isn't a password manager and doesn't replace Keychain. Protect looks through your pictures for photos of cards, IDs and screenshots of codes, and you can move them into the Vault, which has its own pattern or 6-digit PIN. It can miss things, and it doesn't check videos or your Hidden album. The Vault stays on this iPhone and isn't in iCloud or computer backups, so make a backup file if you can't lose what's inside.
Questions
Is iCloud Keychain safe?
Apple says it uses end-to-end encryption, so Apple can't read what's in it. Its safety still depends on your Apple Account password and iPhone passcode, so keep both private.
Should I take a screenshot of a password?
No. It lands in your camera roll, with iCloud Photos on your other devices too. Save it in Passwords instead.
Sources
- Set up iCloud Keychain, Apple Support
- Use the Passwords app to create, manage, and share passwords and passkeys across Apple devices, Apple Support
- iCloud data security overview, Apple Support
- About Stolen Device Protection for iPhone, Apple Support