Partner knows my iPhone passcode: protecting your photos now

If your partner knows your iPhone passcode, they can get into more than your home screen. On iPhone, the passcode is the master key. It unlocks the phone, and it's also the fallback that opens the Hidden album, locked apps and saved passwords. Maybe you shared it years ago, or they watched you type it. Either way, wanting some of your things kept private is reasonable, and you don't need to justify it.

This page covers what to do right now, what the passcode still opens even after you've hidden things, and how to keep photos and documents behind a lock that only you know. If the problem is someone actively going through your phone, see partner going through my phone too.

What to do right now

1. Change your passcode. Go to Settings → Face ID & Passcode (Touch ID & Passcode on iPhones with a Home button) → Change Passcode. To make it harder to guess or pick up by watching, tap Passcode Options and choose a custom alphanumeric code or a longer number. Don't use a birthday, an anniversary or anything they'd guess.
2. Check Face ID for a second face. In Settings → Face ID & Passcode, look for Set Up an Alternate Appearance. If that option is missing, an alternate appearance has already been added. iOS doesn't show whose face it is. If you didn't add it, tap Reset Face ID and set up your own face again. On Touch ID iPhones, check the list of fingerprints and delete any that aren't yours.
3. Change your Apple Account password. Someone with your passcode can change it or see account details. Go to Settings → [your name] → Sign-In & Security → Change Password. On that page, also check which phone numbers are listed as trusted.
4. Review signed-in devices. In Settings → [your name], scroll down to the list of devices. Tap any device you don't recognise and remove it.
5. Run Safety Check. Go to Settings → Privacy & Security → Safety Check. Manage Sharing & Access walks you through who can see your location, shared albums and other shared data, and lets you stop sharing person by person. There's a Quick Exit button if you need to close it fast.
6. Turn on Stolen Device Protection. It's in Settings → Face ID & Passcode → Stolen Device Protection. Away from familiar places, sensitive changes then need your face or fingerprint, not just the passcode. It won't help at home (see below), but it's worth having on.
7. Think about saved passwords. With your passcode, someone can open the Passwords app (or Settings → Passwords on older iOS versions). If they've had unsupervised time with your phone, change the passwords for the accounts that matter most, such as email, banking and cloud storage.

If there's any chance a sudden change will be noticed and cause trouble, read the safety section further down before you do steps 1–5.

What not to rely on

When the other person knows your passcode, a lot of built-in privacy features stop working against them:

• The Hidden album. On iOS 16 and later it's locked by default, but the lock is Face ID or your passcode. On iOS 18 the setting is at Settings → Apps → Photos → Use Face ID; on iOS 17 it's Settings → Photos. Anyone who knows the passcode can open it.
• Locked and hidden apps (iOS 18). These also fall back to the passcode. They stop someone casually picking up your phone, but not someone who knows the code.
• Stolen Device Protection at home. It only asks for biometrics and adds delays away from familiar places. Where you both live counts as familiar, so the passcode works as usual there.
• Deleting a photo once. Deleted photos go to Recently Deleted for about 30 days, and that album opens with the same passcode. See how to permanently delete photos.
• Notes or files with no lock of their own. Notes locked with your device passcode, and documents in the Files app, open with the same code.
• Shared Library and shared albums. If you use iCloud Shared Photo Library, photos may be shared automatically from the Camera. Check Settings → Apps → Photos → Shared Library (Settings → Photos on iOS 17) so private photos aren't going into it.

Underneath all of this, iPhone has one master secret, your passcode, and most locks come back to it. Changing the passcode helps. But if you might share it again, or someone watches you type it again, you're back where you started.

How to set up lasting protection

What lasts is keeping your most private photos and documents behind a second, separate secret that isn't your iPhone passcode and can't be opened by a face added to Face ID.

What to look for in a separate lock

• Its own pattern or passcode, different from your phone's.
• No passcode fallback. If the app accepts your iPhone passcode or any enrolled face, it doesn't protect you here.
• Real encryption, so the files can't be read even if someone copies them off the phone.
• Locks the moment you leave the app, so an unattended phone doesn't leave your files open.
• A recovery method only you hold, so nobody else can reset it with your email or phone number.
• Documents as well as photos, because IDs, medical letters and private notes often matter as much as pictures.

Using an encrypted vault: VaultCave as an example

VaultCave is one option built around this idea. It's a new app for iPhone and iPad (iOS 17 or later) and isn't on the App Store yet. It stores photos, videos and documents encrypted on your device, and PDFs and other files open inside the vault.

1. Create a vault with its own pattern or passcode. Draw a pattern of at least 6 dots on a 5×5 grid, or choose a passcode of at least 6 characters. Make it different from your iPhone passcode. VaultCave has no Face ID or Touch ID by design, so neither your phone passcode nor a face added to Face ID will open it.
2. Save the 12-word recovery phrase. It's shown once, and you type back 3 words to confirm you have it. It's the only way to restore the vault or open it without the pattern, and VaultCave can't reset it. Keep it somewhere the other person can't reach. See how to store a recovery phrase.
3. Decide on backup. Encrypted backup goes to your own iCloud and is on by default. It's encrypted before upload. If someone can sign in to your iCloud account, they could delete the backup but not read it. Restoring always needs the recovery phrase, never the pattern.
4. Move photos and files in. Import from Photos, with the option to delete the originals once the encrypted copy is verified. You can also add files from the Files app or the share sheet. Then empty Recently Deleted in Photos so no copies are left there.
5. Leave auto-lock on "immediately." The vault locks as soon as you leave the app, and the keys are removed from memory. The app switcher shows a privacy cover instead of your photos.

Wrong guesses bring increasing waits. After 10 failed attempts the pattern stops working and only the recovery phrase opens the vault. The unlock screen never lists vaults, so it doesn't show how many exist. How the encryption works is explained on the security page.

Be honest with yourself about the limits. Someone who knows your iPhone passcode can still see that the app is on your phone. Even with a Pro disguised icon, iOS shows the name "VaultCave" under it. And if they watch you draw your vault pattern, they can open that vault, so unlock it where nobody can see the screen.

What a vault doesn't solve

A vault protects files. It can't fix how someone treats you.

• If you feel watched, controlled or afraid, a new passcode or a hidden app won't make things safe, and sudden changes on a phone someone monitors can be noticed. A partner who checks your phone may notice a new passcode, a missing photo or a new app. Changing things more gradually, or using a device they can't get to, may be safer. Talk it through with a domestic-violence service first. In the US, the National Domestic Violence Hotline is 1-800-799-7233. Elsewhere, look for a local domestic-violence helpline.
• If someone threatens to share intimate images of you, StopNCII.org can help stop them being posted on participating platforms. Keep evidence of the threat, and consider talking to the police or a lawyer.
• Being pressured to unlock. No app can stop someone forcing you to open it. VaultCave Pro has a duress mode: a decoy vault whose pattern silently erases the other vaults on the device. Those vaults come back only from encrypted backup with their recovery phrases. Treat it as a last resort, not as protection for an unsafe situation.
• Screenshots and other copies. If a photo was already sent, synced to a shared album or screenshotted, moving your copy into a vault doesn't remove the others.

The short version

• Your iPhone passcode opens the Hidden album, locked apps, saved passwords and Recently Deleted, so if your partner knows it, none of those are private from them.
• Change the passcode, check Face ID for an alternate appearance, change your Apple Account password and run Safety Check.
• Stolen Device Protection helps away from home, but not with someone you live with.
• For lasting privacy, keep your most private photos and documents behind a separate secret that isn't your phone passcode, such as an encrypted vault with its own pattern and a recovery phrase only you keep.
• If you feel unsafe, contact a support service before making changes that might be noticed.