UnderKey vs Storing Documents in Your Photo Gallery
The easiest way to keep a digital copy of your passport or ID is to photograph it with your phone's camera and leave it in your photo library. It's fast, it's convenient, and it works. But it's also one of the least secure places you can store a sensitive document.
The problem with photo galleries
Automatic cloud sync
By default, iCloud Photos (iOS) and Google Photos (Android) automatically back up every photo you take, including ID scans and passport photos. This means:
- Your documents live on Apple or Google's servers, accessible from any device logged into your account.
- Anyone who gains access to your account can see them. If your iCloud or Google account is phished, hacked, or left logged in on a forgotten device, your documents are exposed.
- Turning off sync later doesn't remove what's already uploaded. You have to manually delete the photos from iCloud or Google Photos.
Visible to apps with photo access
Any app you've granted photo library access can see every photo in your camera roll, including ID scans and passport photos. Some photo editing, backup, or social media apps silently upload photos to their own cloud services.
Easy to share by accident
A photo in your camera roll can be accidentally airdropped, attached to the wrong email, posted in a group chat, or uploaded when you mean to send a different picture.
No encryption
Photos in your camera roll are stored unencrypted on your device. If your phone is lost or stolen and someone bypasses the lock screen (or if you don't have one), your documents are readable.
How UnderKey is different
| Feature | Photo gallery | UnderKey |
|---|---|---|
| Automatic cloud sync | Yes (iCloud Photos, Google Photos) | No (never uploaded) |
| Encrypted on device | No (stored unencrypted) | Yes (AES-256-GCM) |
| Visible to other apps | Yes (any app with photo access) | No (isolated app sandbox) |
| Risk of accidental sharing | High (can be airdropped, texted, posted) | Low (must export manually) |
| Access requires unlock pattern | No (visible once phone is unlocked) | Yes (separate unlock for the app) |
| Decoy vaults | No | Yes (each pattern opens a different vault) |
| Expiry reminders | No | Yes (local reminders before documents expire) |
What about disabling cloud sync?
You can turn off iCloud Photos or Google Photos sync, but this has trade-offs:
- You lose automatic backup for all your photos, not just ID scans. Most people don't want to disable cloud backup entirely just to protect a few documents.
- Photos already uploaded stay in the cloud unless you manually delete them.
- Photos are still unencrypted on your device and visible to apps with photo access.
A better approach is to keep everyday photos in your camera roll with cloud sync enabled, and store sensitive documents in an encrypted vault like UnderKey.
What about "Hidden" albums?
iOS and Android both offer "Hidden" albums that hide photos from your main photo library. But:
- Hidden photos still sync to the cloud. They're just hidden from the main view, not from iCloud or Google Photos.
- They're not encrypted. Anyone with your phone's passcode can see the Hidden album.
- They're still accessible to apps with photo access.
Hidden albums are designed for hiding embarrassing photos from friends, not for securing sensitive documents. For a full comparison, see our guide on how to hide photos on iPhone (really hide them).
When photo galleries are fine
For most photos — family pictures, travel snapshots, receipts you'll delete in a week — cloud-synced photo galleries are perfectly fine. The convenience outweighs the risk.
But for documents that prove your identity or can be used to impersonate you — passports, IDs, birth certificates, financial records — the risk is too high. An encrypted vault is the only way to keep them truly secure.
Summary
- Photo galleries sync to the cloud by default, exposing ID scans and passport photos to account hacks and cloud breaches.
- Photos are unencrypted on your device and visible to any app with photo access.
- Hidden albums don't solve the problem — they still sync and aren't encrypted.
- UnderKey encrypts documents on-device with AES-256, never uploads them, and keeps them isolated from other apps.
- Use cloud photo galleries for everyday photos, and an encrypted vault for sensitive documents.