What encryption doesn’t protect: the gaps around a locked file

What encryption is good at

Encryption turns data into noise that only the right key turns back. It is very good at one job: making a copy useless. A file pulled off a drive, a backup lifted from a server, a phone found switched off on a bench. None of those give up their content without the key.

That covers a lot. It does not cover the moment you use your data.

The gaps, one by one

1. The unlocked device

To show you a photo, the app decrypts it. While the phone is unlocked, every app can do that for anyone holding it. Handing over an unlocked phone hands over everything that isn’t behind a second lock.

What closes it: short auto-lock times, and a second lock on the apps that matter. See where private photos still show up.

2. Eyes on the screen

A person beside you on a train reads what you read. No cipher reaches into the room.

What closes it: turning the screen away, and only opening private things where you are alone. Showing someone one photo covers the handover.

3. Screenshots and recordings

A screenshot copies pixels after they are decrypted, and saves them as a new, ordinary image. Screen recording and mirroring to a TV do the same, live.

What closes it: care, and apps that cover their content while recording. The screenshot guide covers where captures end up.

4. A weak or known passcode

Encryption is only as strong as what unlocks the key. A birthday, or a code someone watched you type, opens the door the normal way.

What closes it: a longer code, typed out of sight.

5. Copies you made yourself

Moving a photo into a vault does not reach back into the camera roll, a chat thread, an email or a shared album. Each is a separate copy with its own protection, or none.

What closes it: deleting the originals and the sent copies you control.

6. Who holds the key

Data can be encrypted and still readable by the company, if the company holds the key. By default, Apple keeps the keys for several iCloud categories so it can help you recover them, while others, such as Passwords and Keychain, are end-to-end encrypted from the start (Apple Support). By default, Apple keeps the encryption keys for iCloud Photos, Notes and iCloud Drive in its own data centers so that it can help you recover them, and only the optional Advanced Data Protection makes them end-to-end encrypted.

What closes it: services where only your devices hold the key.

7. What the file says about itself

Even strong encryption usually leaves the outline visible: that a file exists, roughly how big it is, when it changed. The content is safe; the facts around it are not always.

A quick test for any “encrypted” claim

Ask three questions. Encrypted from whom? While doing what? And who holds the key? A claim that answers all three is worth something. One that only names a cipher, such as the ones in the AES guide, answers none of them.

Where Sealed helps, and where it doesn’t

It helps with a second lock that closes when you leave the app. Sealed locks as soon as you leave it unless you choose a delay, and it covers its contents in the app switcher.

It helps while the screen is recorded or mirrored. Sealed covers its contents while the screen is being recorded or mirrored, and that is on by default.

It doesn’t stop screenshots. Sealed warns you after you take a screenshot while a record’s values are showing, and it does not block screenshots.

It doesn’t protect the originals you leave in Photos, or a copy you export. Until you delete them, the originals stay in Photos, outside the vault. In an open item, Export and then Export Unlocked Copy hands a decrypted copy of that one item to the iOS share sheet.

It doesn’t stop someone who knows your vault passcode. Your passcode is a gate in front of the app. It is not part of the key.

It doesn’t mask the outline of a backup: In your iCloud backup, Apple can see each record’s type, a random record name, when the record was created and changed, the size of its files and how many records there are, but not what is in them.