Encrypted iCloud Backup: Ciphertext Only, Restore With a Phrase

What is encrypted backup?

A vault on one Mac is a single point of failure. A dead drive means lost photos. Backup solves that, but a backup that Apple or anyone else can read would undo the point of a vault. Hidden Folder encrypts first and uploads second. The upload goes to your private CloudKit database, which is tied to your own Apple account.

How it works, step by step

1. A separate key

   The backup key is derived from your pattern with a distinct label, so it is not the same key as the one that opens the vault.

2. Encrypt and pad

   Records are encrypted on your Mac and padded, so file sizes are less obvious from the outside.

3. Upload

   Records go to the CloudKit private database. Uploads run in parallel, resume after interruptions and skip duplicates.

4. Restore

   On a new Mac you choose restore, enter your recovery phrase, and the vault comes back. A manifest, encrypted and found through a locator derived from the phrase, tells the app what to fetch.

How the backup behaves

• If iCloud is full, the app backs off before retrying.
• A damaged file stops the backup and is reported, instead of retrying forever.
• The app asks before a sync would remove most of a vault.
• Deleted files stay deleted, and an older copy never overwrites newer changes.
• Opening and importing never wait for the backup.

What the backup still reveals

• That you use the app and have an iCloud backup of it.
• Approximate record counts and sizes. Padding blurs this but does not remove it.
• Timestamps of uploads.

What backup does not protect against

• Losing your recovery phrase. Without it a new Mac cannot restore.
• Someone who has your Apple account and your phrase.
• Duress mode removing a vault locally. The backup is kept, so a removed vault can come back with its own phrase.

If you do not want any cloud copy, you can turn backup off in Settings. The vault then lives only on your Mac, and a failed drive takes it with it.