What's in an iPhone backup, and is it encrypted?
Two kinds of backup
- iCloud Backup is saved to Apple's servers over the internet.
- A computer backup is saved to a Mac or PC that you connect your iPhone to.
What iCloud Backup contains
Apple says it covers the information and settings on your iPhone that don't already sync to iCloud. That includes:
- Your device settings, Home Screen layout and app organisation.
- App data from apps you've downloaded, unless an app keeps its data in iCloud Drive instead.
- Your Apple Watch backup, and purchased ringtones.
- Your messages, unless you use Messages in iCloud. Then they sync to iCloud and are left out.
- Your photos and videos, but only if you don't use iCloud Photos. With it on, they sync to iCloud and aren't part of the backup.
Is an iCloud backup encrypted?
Yes, in two ways. Apple says files are encrypted while they travel, and encrypted when stored, using keys tied to your account. Who holds the key depends on a setting:
- Standard protection (the default): Apple keeps the backup's key in its own secure hardware, so it's not end-to-end encrypted. Apple can generally help you recover things if you lose access, though saved passwords in the keychain are an exception.
- With Advanced Data Protection: the key is protected with end-to-end encryption and is available only on your trusted devices. Apple can't recover it for you. More on that here.
A computer backup
Apple says your backup isn't encrypted by default. If you turn on "Encrypt local backup" and choose a password, the backup is encrypted, and it can include things an unencrypted one leaves out:
- Your saved passwords
- Wi-Fi settings
- Website history
- Health data
- Call history
An encrypted backup doesn't store Face ID, Touch ID or passcode data. The password matters: Apple says that if you forget it, you can't use your previous encrypted backups, though you can make a new backup with a new password.
What this means for a photo vault app
App data goes into iCloud backups. So if a vault app keeps readable files in its own space and doesn't leave them out, copies end up in the backup. A good vault app either encrypts its files or leaves them out of backups. Here's what to ask.
How FirstHour handles backups
- The Vault's files are left out of iCloud and computer backups, and its locked key is set to stay on this iPhone. So restoring a new iPhone from an iPhone backup does not bring your Vault back.
- You can save an encrypted Vault backup file yourself, wherever you choose, such as the Files app. Restoring it takes your recovery phrase. It isn't automatic, and it holds only what was in the Vault when you made it.
- Some ordinary settings are included in iPhone backups, such as your Plan B providers and numbers. Your pattern, PIN and recovery phrase aren't stored.
- Pictures still in Photos follow your Photos and backup settings, not the Vault's.
- A backup file you save yourself is protected by your recovery phrase alone, not by your iPhone's chip, so it has to be hard to guess.
- There's no outside audit of this yet.
Questions
Should I encrypt my computer backup?
If you make one, it's worth considering, since it protects more of what's in it. Write the password down somewhere safe. Apple says that if you forget it, you can't use your previous encrypted backups.
Is a backup the same as iCloud Photos?
No. iCloud Photos keeps your photos in sync across your devices. A backup is a saved copy of the rest of your iPhone.
Sources
- What does iCloud back up?, Apple Support
- About encrypted backups on your iPhone, iPad, or iPod touch, Apple Support
- iCloud Backup security, Apple Platform Security
- iCloud data security overview, Apple Support