Security, in plain English
How Hideroom keeps what’s yours, yours.
Photos, videos, papers and recovery words get the same protection. Some parts are weaker than they sound, so we start with those.
Checked against Hideroom’s security design, version 1, 23 October 2026.
The short version
- Hidden isn’t the same as locked.
- Everything you add is encrypted on your phone with AES-256-GCM before anything is backed up.
- The room’s key is random and made on the phone; your pattern plus a secret that never leaves the phone unlock it.
- Backups hold only locked files, in your own private iCloud (Google Drive on Android), never with Hideroom.
- Hideroom has no account, no server that sees what you keep, and no copy of your keys.
- A nine-word recovery phrase that Hideroom generates opens a room on any phone.
What’s encrypted
Encrypted · On your phone
- Photos and videos
- Documents and notes
- File names
- Dates taken
- Locations inside photos
- Album and room names
- Thumbnails
- How many items a room holds
Not hidden
- That Hideroom is installed
- The total size of your backup, and when it changed
Neither iPhone nor Android lets an app hide these. A full decoy room is the answer if someone asks.
Where it happens
Three stops: your phone, your own iCloud, and us. Nothing reaches us.
- 1 of 3
On your phone
Your pattern and a secret that never leaves this phone unlock the room’s key. Every photo gets its own key and is locked with AES-256-GCM, the encryption built into iPhone and Android.
Files are sealed in 1 MiB chunks, so a 2 GB video plays straight from its encrypted file and nothing decrypted ever touches the disk.
- 2 of 3
In your own iCloud
Only locked files go to your own private iCloud, or Google Drive on Android, never to Hideroom. Hideroom reads back every upload to check it, and opens a sample each week to prove it restores.
Only your recovery phrase can open a backup. The pattern never leaves the phone, so a stolen backup can’t be attacked by guessing patterns.
- 3 of 3
At Hideroom
Nothing. The app has no account and no Hideroom server, so there’s nothing of yours for us to see, hand over or leak.
There’s no Hideroom copy of your keys, your files or your email address.
Who holds the keys
Your locked files can sit with Apple or Google. The keys never do.
| Who | What they hold | What they can see |
|---|---|---|
| You | Your pattern and your recovery phrase | Everything, on your phone |
| This phone | A secret key in the Keychain or Android Keystore | Nothing on its own: it needs your pattern |
| Apple or Google | Your locked files, in your own iCloud or Google Drive | That locked files exist, and how big they are |
| Hideroom | Nothing: no account, no server that sees your files, no copy of your keys | Nothing |
| Someone with a court order | Can get your locked files from Apple or Google | Nothing, without your phone or your recovery phrase. Hideroom has nothing to hand over. |
You
- What they hold
- Your pattern and your recovery phrase
- What they can see
- Everything, on your phone
This phone
- What they hold
- A secret key in the Keychain or Android Keystore
- What they can see
- Nothing on its own: it needs your pattern
Apple or Google
- What they hold
- Your locked files, in your own iCloud or Google Drive
- What they can see
- That locked files exist, and how big they are
Hideroom
- What they hold
- Nothing: no account, no server that sees your files, no copy of your keys
- What they can see
- Nothing
Someone with a court order
- What they hold
- Can get your locked files from Apple or Google
- What they can see
- Nothing, without your phone or your recovery phrase. Hideroom has nothing to hand over.
How a room is locked
1. Your pattern, plus this phone’s secret
A secret kept in the iPhone Keychain or Android Keystore. It never leaves the phone.
2. A key made on the phone
Stretched 600,000 times on iPhone, so every guess is slow.
3. Each file locked with its own key
Using AES-256-GCM, the encryption built into iPhone and Android.
Your recovery phrase opens the same room key on any phone.
Under the hood
Every parameter, in words. If the security design changes, this page changes the same day.
- Files
- AES-256-GCM, a key per file, in 1 MiB chunks
- Room key
- Random 256-bit, one per room
- Pattern
- PBKDF2-HMAC-SHA256, 600,000 rounds on iPhone and tuned per phone on Android, mixed with a key held in the Keychain or Android Keystore
- Recovery phrase
- Nine generated words, about 87 bits
- Guess limits
- Five free tries, then waits that grow to an hour
- Backup
- Only locked files, in your own private iCloud (Google Drive on Android), encrypted before upload, read back and checked. Only the recovery phrase can open it: the pattern never leaves the phone, so a stolen backup can’t be attacked by guessing patterns
- Crypto
- Apple’s and Android’s own libraries; nothing hand-rolled
From the security design, version 1, checked 23 October 2026.
Strength, honestly
We start with the weak part, because it’s what makes the strong parts believable.
| What protects you | Strength | The honest number, in plain words | What an attacker would need |
|---|---|---|---|
| Your pattern on its own | Weak | People draw familiar shapes. A typical pattern falls within the first million guesses, and about one in five within the first 10,000. One high-end graphics card can try a million in about a minute. That’s why it never works alone. | A copy of your files and this phone’s secret key |
| Your pattern plus this phone’s secret, at the lock screen | Strong | After five tries, Hideroom makes people wait, up to an hour a try. That’s about 24 tries a day, so a million would take more than 100 years. | Your unlocked phone, and decades |
| A copy of your files or backup, without your phone | Very strong | Without the phone, not a single pattern can even be tested. | Your phone, or your recovery phrase |
| Your recovery phrase | Very strong | Hideroom always makes it: nine words, about 87 bits, around 10²⁶ possibilities. Trying them all on a top graphics card would take about 300 trillion years. | The phrase itself |
| Each photo’s encryption | Very strong | AES-256-GCM, built into iPhone and Android, with a separate key for every file. There’s no known practical attack. | The key |
| Someone who has broken into your phone’s software with forensic tools | Depends on your pattern | On Android, every guess still has to go through the phone’s security chip: hours to a day for a typical pattern. On iPhone, a lab that copies the phone’s keychain could test a typical pattern within minutes, so draw a longer pattern if this is your worry. | Lab tools, your phone, and a way past its passcode |
Your pattern on its own
WeakPeople draw familiar shapes. A typical pattern falls within the first million guesses, and about one in five within the first 10,000. One high-end graphics card can try a million in about a minute. That’s why it never works alone.
What an attacker would need: A copy of your files and this phone’s secret key
Your pattern plus this phone’s secret, at the lock screen
StrongAfter five tries, Hideroom makes people wait, up to an hour a try. That’s about 24 tries a day, so a million would take more than 100 years.
What an attacker would need: Your unlocked phone, and decades
A copy of your files or backup, without your phone
Very strongWithout the phone, not a single pattern can even be tested.
What an attacker would need: Your phone, or your recovery phrase
Your recovery phrase
Very strongHideroom always makes it: nine words, about 87 bits, around 10²⁶ possibilities. Trying them all on a top graphics card would take about 300 trillion years.
What an attacker would need: The phrase itself
Each photo’s encryption
Very strongAES-256-GCM, built into iPhone and Android, with a separate key for every file. There’s no known practical attack.
What an attacker would need: The key
Someone who has broken into your phone’s software with forensic tools
Depends on your patternOn Android, every guess still has to go through the phone’s security chip: hours to a day for a typical pattern. On iPhone, a lab that copies the phone’s keychain could test a typical pattern within minutes, so draw a longer pattern if this is your worry.
What an attacker would need: Lab tools, your phone, and a way past its passcode
There are about 24 billion possible patterns of 6 to 8 lights, but people draw familiar shapes, so we treat a pattern like a short PIN and never let it work alone.
Backed up, and checked
The sage badge is earned only when all four of these hold:
- 1Every item is confirmed in your iCloud after it uploads.
- 2The room’s recovery key and its list of contents are confirmed too.
- 3A sample check passed in the last 7 days: Hideroom downloads part of the room and opens it.
- 4The room’s recovery phrase has been shown and confirmed. A backup nobody can open isn’t a backup.
Check my backup
Type your recovery phrase and Hideroom fetches ten random photos from your backup in your iCloud, not the phone, and opens them in memory. “These came back from your backup using your recovery phrase.” The phrase is used once and never stored.
Your recovery phrase
Nine words Hideroom generates, about 87 bits. They’re shown once, never stored by Hideroom, and they open the room on any phone. There are no paid resets.
You can’t choose your own words, because people choose guessable ones.
If someone makes you unlock
The wipe pattern Pro
Drawing your wipe pattern opens this room. Straight away, every other room on this phone is erased: its photos and its pattern. Your backup isn’t touched, so you can bring each room back later, on any phone, with its recovery phrase. Anything that wasn’t backed up yet is gone for good.
- Looks like any other patternThe same light, the same door, the same timing. Nothing on screen says what happened.
- Settings never tellEvery room’s settings show the same “Wipe pattern” row, whether one is set or not.
- Keep backup on where it mattersOnly what’s already backed up can come back, so Hideroom shows the room’s backup state before you set one.
- Works offline, stays setIt needs no signal, and a plan that ends never switches it off.
Decoy rooms Pro
Any other pattern opens another room, and nothing marks which one is real. Put believable things in one, and it can be the room you show.
- Capture lock FreeLocks the moment your screen is recorded, mirrored or screenshotted, and hides from the app switcher.
- Hide my drawing FreeYour pattern’s line stays invisible to anyone watching.
- Private icons ProSwap Hideroom’s icon for a quieter one. It’s an icon, never a fake calculator.
Any room can be a decoy, and nothing marks one. Put believable things in it: an empty room next to a phone using 4 GB tells its own story.
What still shows: that Hideroom is installed and roughly how much it stores, and, to someone examining the phone’s files, roughly how many rooms are in use. Never what’s in them.
It can’t stop someone who also takes your iCloud account and your recovery phrases, or who compared the phone’s storage before and after.
Your safety comes first. If handing over your phone is the safer thing to do, do that.
Hideroom is for keeping your own private things safe under pressure, not for hiding wrongdoing. Legal requests and misuse
What we can’t protect you from
- Someone watching over your shoulder as you draw. Turn on Hide my drawing.
- A phone that’s already been hacked or unlocked by someone else.
- A recovery phrase someone else has seen.
- A screenshot taken while a room is open. Hideroom locks straight after, but the screenshot stays in Photos.
- Forgetting both your pattern and your recovery phrase. Nobody can open the room, including us.
Don’t trust us, check
Everything on this page will be published for anyone to read and check.
The security design
How every part works, in full, with the numbers on this page.
Publishing before launch
Test vectors
Known inputs and outputs that both apps must pass, so anyone can check the maths.
Publishing before launch
The vault module’s source
The Swift and Kotlin code that does the encryption, published for anyone to read and check.
Publishing before launch
The desktop recovery tool
Opens a backup folder with your recovery phrase and writes your photos out as ordinary files. Apache-2.0.
Publishing before launch
Legal requests and misuse
Hideroom can’t see what’s in your rooms, so it can’t scan them or hand them over. Using Hideroom for illegal material is against our terms.
With no account and no server that holds your files, a legal request reaches nothing we can read. We’ll say here if we ever receive one.
Questions people ask
Can Apple or Google see my photos?
No. Everything is encrypted on your phone before it reaches iCloud or Google Drive, and the keys stay on your phone or in your recovery phrase. Apple and Google store locked files they can’t open.
I’m in the UK and can’t turn on Advanced Data Protection. Does that matter?
Not for what you keep in Hideroom. Apple can no longer offer Advanced Data Protection to new UK users, so Apple holds the keys to your ordinary iCloud Photos. Hideroom encrypts everything on your phone first, so your iCloud only ever holds files Apple can’t read.
What happens to my backup if I use the wipe pattern?
Nothing happens to it: it stays in your own iCloud. The wipe pattern erases the other rooms from this phone only, and you can bring each one back later, on any phone, with its recovery phrase. Anything that wasn’t backed up yet is gone for good.
Could Hideroom open my rooms if the police asked?
No. Hideroom has no account, no server that receives your photos and no copy of your keys, so there’s nothing for us to open or hand over. Your locked files sit in your own iCloud or Google Drive, and they can’t be opened without your phone or your recovery phrase.
Has Hideroom been audited?
Not yet. We recommend an outside review before launch, and this answer will change, with who did it and when, the day one is done. Until then, the security design and its test vectors will be published for anyone to read and check.
What if Hideroom shuts down?
Your backup stays in your own private iCloud, because Hideroom never held it. We’ll publish a desktop recovery tool that opens a backup folder with your recovery phrase and writes your photos out as ordinary files.
Report a security problem
If you think you’ve found a weakness in Hideroom or this website, email us. Tell us what you found, how to reproduce it, and what it could expose. We’ll reply within 3 working days and keep you posted until it’s fixed.
security@hideroom.appOur security.txt
Last checked 24 October 2026