"Is iCloud secure?" has two honest answers. Against outside attackers, iCloud is reasonably secure - encrypted in transit and at rest, with two-factor authentication and a mature security team. But by default it is not zero-knowledge: for standard iCloud, Apple holds the keys to most of your data and sits under US jurisdiction. Apple does offer Advanced Data Protection, an opt-in end-to-end encryption mode - genuinely strong, but off by default and with exceptions. This guide explains the difference and how to make your files truly private.
What iCloud protects by default
- Encryption in transit and at rest for your data.
- Two-factor authentication to protect your Apple Account.
- A mature security program across Apple's ecosystem.
Against hackers and interception, that's a solid baseline. The catch is who else can read your data.
The default isn't zero-knowledge
For standard iCloud, Apple manages the encryption keys for most categories. That means Apple can technically access the data, and - as a US company - can be compelled to disclose it under legal process. This is structural, not a bug: "secure against outsiders" is simply not the same as "private from the provider." (For the background, see our end-to-end encryption explainer and E2E vs zero-knowledge guide.)
Advanced Data Protection: strong, but opt-in
In late 2022 Apple introduced Advanced Data Protection (ADP). Turn it on and end-to-end encryption extends to most iCloud categories - iCloud Backup, Photos, Notes and more - so only your trusted devices hold the keys and Apple itself cannot read them.
Two things to know:
- It's off by default. Most users have never enabled it, so most iCloud data is not end-to-end encrypted in practice.
- You own recovery. With ADP on, Apple can't recover your data if you're locked out, so you must set up a recovery key or recovery contact.
A few categories stay encrypted-but-accessible even with ADP - notably iCloud Mail, Contacts and Calendar - because they interoperate with global systems. So email and contacts in iCloud are never private from Apple.
Want zero-knowledge by default instead? pCloud + Crypto
Swiss jurisdiction · Client-side encryption with the Crypto add-on · Lifetime plans
How to turn on Advanced Data Protection
If you stay on iCloud, enabling ADP is the single biggest privacy upgrade - and it's free:
- Make sure two-factor authentication is on for your Apple Account and you have a device passcode.
- Update every device signed into iCloud to a recent OS - ADP requires all of them to support it (older devices must be removed from the account).
- On iPhone/iPad: Settings → [your name] → iCloud → Advanced Data Protection → Turn On. On Mac: System Settings → [your name] → iCloud → Advanced Data Protection.
- Set up account recovery first - a recovery key or a recovery contact. With ADP, Apple holds no keys, so without this you can permanently lose access if locked out.
That's it - most iCloud categories become end-to-end encrypted from then on.
Lock down your iCloud: a quick checklist
- Two-factor authentication on, with trusted phone numbers current.
- A strong, unique Apple Account password kept in a password manager.
- Advanced Data Protection enabled, with a recovery key saved somewhere safe.
- Review trusted devices periodically and remove any you no longer use.
- Remember Mail, Contacts and Calendar stay readable by Apple even with ADP - keep truly sensitive material out of them, or in a zero-knowledge service.
So - is iCloud secure enough for you?
- For ordinary files and convenience: yes, especially with 2FA on and Advanced Data Protection enabled.
- For genuinely sensitive data: turn ADP on at minimum - and remember Mail, Contacts and Calendar still aren't end-to-end.
- For true privacy by design: a zero-knowledge provider keeps the keys with you from the start, with no setting to forget - see our Proton Drive review or the business-grade Tresorit review. See how iCloud compares to other providers in is Google Drive secure?
The bottom line
iCloud is secure against hackers and, with Advanced Data Protection enabled, can be genuinely private - end-to-end encrypted so even Apple can't read most of your data. But that's opt-in, off by default, and Mail/Contacts/Calendar are never end-to-end, all under US jurisdiction. If privacy matters, enable ADP today; if you want zero-knowledge with nothing to switch on, a provider that's private by design is the cleaner answer.
Frequently asked questions
- Is iCloud secure?
- Against outside attackers, reasonably yes: iCloud encrypts data in transit and at rest, supports two-factor authentication, and runs a mature security program. By default, though, it is not zero-knowledge - for standard iCloud, Apple holds the encryption keys for most data, so it can technically access it and can be compelled to hand data over under US law. Apple does offer Advanced Data Protection, an opt-in setting that turns on end-to-end encryption for most iCloud categories so only your trusted devices hold the keys. It's genuinely strong, but it is off by default and some categories are never end-to-end. So iCloud can be very private - but only if you turn that on, and with caveats.
- What is Advanced Data Protection for iCloud?
- Advanced Data Protection (ADP) is an opt-in feature Apple introduced in late 2022 that extends end-to-end encryption to most iCloud data categories - including iCloud Backup, Photos, Notes and more - so that only your trusted devices can decrypt them and Apple itself cannot. With ADP on, even Apple can't read that data or hand it over in readable form. The trade-offs: you must set it up and keep a recovery method (a recovery key or contact), because if you lose access Apple can't recover the data for you. It is one of the strongest privacy options a mainstream cloud offers - but it is not the default, so most users don't have it.
- Which iCloud data is not end-to-end encrypted?
- Even with Advanced Data Protection enabled, Apple states that a few categories remain encrypted in transit and at rest but not end-to-end - notably iCloud Mail, Contacts and Calendar, largely because those need to interoperate with global email and scheduling systems. Without ADP (the default), the list of merely encrypted-but-accessible data is much longer, including iCloud Backup, which can contain a copy of a lot of your device. The practical takeaway: email, contacts and calendar in iCloud are not private from Apple even at the highest setting, so treat them accordingly.
- Is iCloud private from Apple and governments?
- By default, no - for standard iCloud, Apple holds the keys to most data and operates under US jurisdiction, so it can access that data and can be legally compelled to disclose it. With Advanced Data Protection enabled, the end-to-end categories become private from Apple and from legal demands in readable form, because Apple no longer holds the keys. But the non-end-to-end categories (Mail, Contacts, Calendar) stay accessible, and US jurisdiction still applies to whatever Apple can technically reach. 'Secure from hackers' and 'private from the provider' are different questions, and iCloud only answers the second one well if you opt in.
- What are more private alternatives to iCloud?
- If you want zero-knowledge by default - where the provider cannot read your files at all - consider pCloud (Swiss, with the Crypto add-on for client-side encryption and lifetime plans), Proton Drive (end-to-end encrypted by default, Swiss jurisdiction), or Tresorit (business-grade zero-knowledge). These keep the keys with you by design rather than as an opt-in. You can also stay on iCloud but encrypt sensitive files yourself before upload with a client-side tool, so iCloud only ever stores ciphertext it cannot read.
Get encrypted cloud storage → pCloud
Swiss-based · client-side Crypto add-on · lifetime plans
