What Hidden can and can't protect against

Hidden makes private things much harder to reach, but no app can protect against everything. Here is what it does well, where it stops, and what you can do about it. The full technical detail is in the security whitepaper.

What it is

What Hidden protects against

Someone browsing your unlocked iPhone. Hidden items never appear in All items, folders, shelves, the vault’s search, the AI helper or notifications. Hidden needs Face ID every time, and locks when you leave the app or after 5 minutes.
Someone who knows your iPhone’s passcode, if you add a Hidden code or pattern. Then neither Face ID alone nor the phone’s passcode can open Hidden.
Someone guessing your Hidden passcode. After 5 wrong tries, waits grow to an hour per try, and restarting or reinstalling the app doesn’t reset them.
Reading the files off the phone. Everything Paperwise stores is encrypted with its own key. Hidden items also have their own keys, held behind Face ID (and your Hidden passcode, if set).
The cloud. Synced and backed-up hidden items are encrypted on your iPhone under Hidden’s own keys. Our server and Apple can’t open them.
AI. Hidden items are never sent to AI.
Being forced to open one space (Pro). Separate spaces and the emergency passcode reduce what someone can make you show.

Known limits

Face ID alone is the default

Without a Hidden passcode, Hidden is exactly as strong as the Face ID check on that phone: anyone who can pass it can open Hidden. What to do: add a code or pattern in Hidden settings → Unlock.

A compromised iPhone

Malware or a jailbreak that controls your phone while Hidden is unlocked can see what you see. What to do: keep iOS up to date and don’t install profiles or apps you don’t trust.

Coercion

Someone who forces you to unlock can see the space you open. Separate spaces and the emergency passcode reduce this risk; they can’t remove it. The emergency passcode erases other spaces on that iPhone only: synced and backed-up copies stay, encrypted, and can be restored with their recovery keys. It also loses Lock Screen camera shots that no space has imported yet.

Screenshots and the app switcher are best effort

Hidden blocks screenshots and screen recording, and covers the app in the app switcher. iOS doesn’t let any app block every capture (another camera pointed at the screen, for example), and iOS takes the app-switcher snapshot at a moment we don’t control.

What counts and sizes reveal

Someone who can examine the iPhone’s decrypted database can see how many hidden items exist, though not which space they belong to.
Our server sees how many hidden items you sync, their sizes and when they change, not what they are.
Anyone with your account key (any of your paired devices, or someone with your account recovery key) can count your synced hidden items and see their kinds and sizes, but not open them.
iCloud’s storage figure for Paperwise includes the backup copies of erased spaces.

Counting spaces from inside a space

Paperwise never lists or counts spaces, but someone who can open one space can learn, slowly, whether Hidden has room for another space, by trying to create one. Each try is limited to once per 24 hours, asks for Face ID and counts as a wrong passcode try.

Shared links from hidden items stay valid

Share links (Pro) you made from hidden items keep working until they expire (7 days at most) or are revoked. After an emergency unlock, the list of those links is cleared from the app, but the links themselves still work until then. Anyone who opened a link may also have saved a copy. What to do: if you’re signed in, Revoke all in Vault → Shared links stops every link you’ve made.

Photos you moved in were in Photos first

Photos and videos moved from your camera roll were in Photos (and in iCloud Photos, if it’s on) before you moved them, and deleted originals stay in Photos → Recently Deleted for up to 30 days. What to do: empty Recently Deleted, and use the private camera for new photos. See Move photos out of Photos.

Copies you make leave Hidden

Export to Photos, Share a copy… and Share PDF create readable copies outside Hidden. Unhide moves an item back to your vault, which is encrypted with a key kept on this iPhone but not behind Face ID: something running as Paperwise on your unlocked iPhone could read it. Keep the app lock on.

Losing every key

If you lose your recovery key and Face ID changes or you forget your passcode, what’s in Hidden can’t be opened, by you or by us. If you lose every device and the recovery key, nobody can recover it.

Secrets in memory

Passcodes and some keys exist briefly in the app’s memory and can’t be wiped from it with certainty.

Restarting the iPhone during a wait

Restarting the iPhone starts an unfinished passcode wait again. It never makes the wait shorter.

Apple and iOS

The Secure Enclave, the Keychain, Face ID and iOS itself are part of what Hidden relies on.

Free and Pro

The protections on this page apply to Hidden on every plan. Separate spaces, the emergency passcode, share links and sync are Pro.

Privacy

We’d rather you know the limits than trust a promise we can’t keep. An independent security audit is planned, not done yet. If you find something we’ve missed, write to security@paperwise.app.

Tips

Add a Hidden code or pattern. It’s the single biggest step up from the default.
Keep each recovery key away from the phone.
Start scans from inside Hidden, so they never pass through your vault.

What if…

What if I think someone saw my Hidden passcode?

Open Hidden and change it: Hidden settings → Unlock → Change code or pattern…. Turn off Show pattern while drawing if you use a pattern.

What if my iPhone is lost or stolen?

Hidden needs Face ID to open. With Face ID only, Hidden is as strong as Face ID on that phone; with a Hidden code or pattern, someone would also need that code. See If you lose your phone.