Locked Notes vs. a Private Notes Vault: Which Actually Protects You?

How locked notes actually work

Since iOS 16, Apple lets you lock an individual note in one of two ways: with your device passcode (unlockable by Face ID or Touch ID) or with a separate password created just for Notes (Apple Support). Once locked, the note's contents are end-to-end encrypted, meaning it's encrypted with a key derived from your passcode or Notes password using PBKDF2 and AES-GCM, and only decrypted when you unlock it (Apple).

That's a real, well-engineered protection, but it comes with limits worth knowing before you rely on it:

That last point is the practical trade-off. Locking a note doesn't take it out of your Apple ecosystem, it stays tied to iCloud, syncing quietly to your iPad, Mac, and the iCloud website. If someone has your Apple ID password and can reset your Notes password (Apple does support recovery flows for the Notes-specific password), or if a device you're signed into is compromised, the protection depends on how well that whole account is secured, not just the note itself. It's also worth noting that while the note body is encrypted, some metadata around it isn't, so "locked" doesn't mean everything about that note is invisible to Apple's infrastructure (Apple).

• You can't lock a note that has a PDF, audio, video, Keynote, Pages, or Numbers attachment.
• You can't lock notes that sync with a non-iCloud account (like Gmail or Exchange), or Quick Notes.
• You can't lock a note that's shared with someone else in iCloud.
• Locked notes still sync across every device signed into the same Apple Account through iCloud, and removing the lock on one device removes it everywhere (Apple Support).

What a separate notes vault does differently

A dedicated vault app takes a different approach: instead of locking a note in place inside the Notes app, it moves the content into a completely separate storage space with its own PIN or Face ID, one that isn't part of the Notes/iCloud sync chain at all.

Secure Folder: Incogni Vault, for example, lets you store notes and documents inside its hidden gallery, locked behind a vault PIN that is separate from both your phone's passcode and your Apple ID. Content placed in the vault stays on the device and isn't uploaded anywhere; there's no account and no content server, so the developer can't see or recover what's stored there. The only data that leaves the app at all is anonymous usage analytics (which feature was opened, not what's inside it), collected through Firebase Analytics.

That separation is the core difference from Apple's approach. Because the vault isn't part of iCloud sync, gaining access to your Apple ID doesn't automatically expose vault contents the way it could theoretically expose an iCloud-synced locked note. The trade-off runs the other way, too: there's no iCloud backup of vault content, so if you lose the device, that content isn't recoverable by anyone, including the developer. Anything irreplaceable should have its own separate backup, and there's no password-reset service standing behind a forgotten vault PIN.

Secure Folder also adds two things Apple's locked Notes doesn't have. A decoy vault opens a second, separate PIN into what looks like a normal, harmless vault, with no setting or badge anywhere that reveals a real vault exists behind a different PIN. And stealth mode can disguise the app itself, its home-screen icon and name, as one of nine ordinary-looking apps such as a calculator or calendar, so the presence of a vault at all isn't obvious from your home screen, App Library, or search.

Which one should you actually use

Neither tool is "more secure" in some abstract sense, they protect against different things.

Apple's locked Notes is the right call when the note needs to stay a note: something you'll keep editing, searching alongside your other notes, and syncing across your iPhone, iPad, and Mac. It's built in, free, and backed by real encryption for the note's contents.

A separate vault makes more sense when what you're storing doesn't need to sync anywhere, when you specifically don't want it tied to your Apple ID or discoverable if someone picks up your unlocked phone and starts browsing apps, or when you want a second layer, a decoy PIN or a disguised icon, that Apple's built-in lock simply doesn't offer.

Many people end up using both: Apple's lock for notes they're actively working across devices, and a vault for anything they want kept off iCloud entirely and out of sight on the phone itself.