Additional resource for the lesson “Hiding Photos on Your Phone: The Built-In Options” — Online Security course
Wanting to hide photos on your phone is a normal thing, and the reasons are usually ordinary: handing the phone to someone to show one picture, and not scrolling into the next. Both iOS and Android have this built in, and it is worth knowing what it actually protects against.
A. Why this matters
The usual situation is not dramatic: you pass your phone to someone to show them a photograph, and they swipe. Or you open your gallery in a meeting and a thumbnail is visible to the room.
Both iOS and Android have built-in ways to keep certain images out of the main gallery, and on both they can be locked behind the same biometric check that unlocks the phone.
The key idea: be clear about who you are protecting against. Against a person holding your phone, the built-in features work well. Against someone with technical access to an unlocked device, they are organisation rather than security.
B. Key concepts
Six ideas about what these features are and are not.
Photos moved out of the main library into a Hidden album, which can be locked with Face ID or Touch ID and removed from the sidebar entirely.
Why it matters to you: It solves the everyday case well. On recent versions it is locked by default, which is the improvement that made it genuinely useful.
The Locked Folder on Android
In Google Photos, a folder protected by the device unlock, whose contents do not appear in the gallery, in backups, or in other apps.
Why it matters to you: The important detail: items in the Locked Folder are not backed up. If you lose the phone, they are gone — which is a trade worth making deliberately.
What this protects against
Someone scrolling on your unlocked phone, a thumbnail appearing in a shared context, an app that reads your gallery.
Why it matters to you: This is the realistic threat for almost everyone, and the built-in features address it directly.
What it does not protect against
Someone with your unlock code, or with technical access to an unlocked device.
Why it matters to you: Worth being explicit about, because ‘hidden’ can sound stronger than it is. The protection is device encryption and your passcode; this is organisation on top of that.
Photo metadata
Photographs carry data about when and often where they were taken, and with what device.
Why it matters to you: This matters more than hiding when sharing a photo. A picture sent to someone can reveal the location where it was taken unless that has been removed — both platforms now offer an option when sharing.
Third-party vault apps
Applications offering to hide photos behind their own code.
Why it matters to you: This category deserves caution. It is crowded with poor-quality products, some of which have leaked the very contents they were hiding, and it asks you to grant an unknown app access to your entire gallery. The built-in options are safer and free.
C. A practical example: passing the phone
You want to show someone a photograph from last week. You unlock the phone, open the gallery, and hand it over.
- They look at the photograph.
- Then they swipe, as people do, and see the next one, and the one after that.
Nothing malicious happened. This is the situation the built-in features exist for, and it is by far the most common.
With the feature in use
- The images you would rather not have appear are in the Hidden album or Locked Folder.
- They do not show in the main gallery, in recent items, or in the memories the phone assembles by itself.
- Opening them requires the biometric check, which the person holding your phone does not have.
One thing worth checking on Android: items in the Locked Folder are excluded from backup. Deliberately putting something there means deciding it will not be recoverable if the phone is lost.
D. Try it yourself: set it up and check the metadata
Fifteen minutes, and the second half applies every time you share a photograph.
Step 1 — Find the feature
- iOS: select a photo, share menu, Hide. Then check that the Hidden album is locked and not shown in the sidebar.
- Android: in Google Photos, select a photo, Move to Locked Folder.
Step 2 — Confirm the lock
- Close the gallery, reopen it, and check that the hidden items require a biometric check or the device code.
- If they do not, the setting is not what you assumed.
Step 3 — Understand the backup implication
- Android’s Locked Folder is excluded from backup.
- If something in there matters, keep a separate copy somewhere encrypted.
- Both platforms let you remove location data when sharing.
- Try it once with a photo taken at home: look at what is attached before and after.
Step 4 is the one with the broadest application. Hiding photos affects your own device; removing metadata affects every photograph you send to anyone.
E. Videos, articles and further resources
Independent and institutional sources in English.
FTC — Online privacy and security
General guidance on personal information, including what is shared without being noticed.
https://consumer.ftc.gov/identity-theft-and-online-security/online-privacy-and-security
EFF — Keeping your data safe
Device encryption, which is the protection underneath everything in this resource.
https://ssd.eff.org/module/keeping-your-data-safe
NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family
ConnectSafely — Parent and educator guides
Useful if the images involve family or younger people, where the considerations are different.
https://www.connectsafely.org/guides-2/
Google Safety Center — Security tips
Where the Locked Folder is and how it behaves. Platform documentation.
https://safety.google/security/security-tips/
CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world
Links checked in August 2026. Apple and Google document the Hidden album and Locked Folder directly, and those pages are the accurate reference for your version.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Skills pillar at level FL2 and is unusually practical: two features and one habit.
Skills
- Using the Hidden album or Locked Folder and confirming it is actually locked.
- Removing location data when sharing a photograph.
- Judging whether a third-party app deserves access to your gallery.
For professionals and organizations
- Being aware that photographs taken at work can carry location and time data when shared externally.
Awareness
- Understanding that this protects against a person, not against technical access.
- Knowing that the Locked Folder on Android is excluded from backup.
- Recognising that photo metadata travels with the image.
For future instructors and ambassadors
- Treating the reason for wanting this as nobody’s business. People have ordinary reasons, and the feature is a normal part of the phone.
Secure Behavior
- Keeping a strong device code, which is the actual protection underneath.
- Removing location data before sharing photographs.
- Preferring built-in features over third-party vault apps.
For organizations
- Including metadata in guidance about sharing images externally.
G. Questions to sit with
- When you hand your phone to someone to show a photo, what happens if they swipe?
- Do you know whether your hidden album is actually locked, or just out of the way?
- Have you ever looked at what data is attached to a photograph you sent?
- Do you have a third-party app with access to your entire gallery? What is it for?
H. What to do now
The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply.
The device underneath
- R5, MS4 — A strong device code, which is what encrypts the storage and locks these features.
- R7 — A short screen lock timeout.
- MS3 — Biometrics are the right choice here: they lock the album without revealing a code to anyone watching.
What leaves the device
- R32 — Turn off location tagging on the camera, which removes the issue at source.
- MS7 — Review which apps have access to your photos, and revoke what does not need it.
- R19 — Remember that anything excluded from backup is not recoverable.
In short
- Both iOS and Android have this built in, and on recent versions it is locked by default.
- It protects against a person holding your phone — which is the realistic situation.
- Android’s Locked Folder is not backed up: decide that deliberately.
- Removing location data before sharing matters more often than hiding does.
Related resources in this course
The protections underneath:
- Data Encryption: Already On, and Worth Understanding
- Phone Passcode Security: Choosing the Right Unlock Method
- App Permissions Guide: Protect Your Security
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply