Is Apple Notes Private? Only If You Lock the Note

Apple markets privacy harder than any other big tech company, so most iPhone owners assume the Notes app is private by definition. The real answer is more specific, and more interesting: Apple Notes is the only preinstalled notes app from a major vendor that can be genuinely private, but only if you turn the right features on. Out of the box, it is not.

This is an audit of where the line actually sits: what Apple can read, what it cannot, and the three gaps people miss. Full disclosure: I build Scrib, an encrypted notes app for Android and Windows. Apple Notes does not compete with it on iPhone, so this one is easy to keep honest.

The Default: Apple Holds the Keys

When you write a note on an iPhone signed into iCloud, it syncs to Apple's servers. That data is encrypted in transit and encrypted at rest, which sounds reassuring and is also true of Google Keep, Samsung Notes, OneNote, and every other mainstream notes service. The question that separates marketing from privacy is: who holds the decryption key?

For standard iCloud notes, Apple does. Apple's own iCloud security documentation lists Notes in the standard protection category: encrypted, but with keys Apple controls. Three consequences follow, the same three that apply to Google Keep and Samsung Notes:

• Apple can technically decrypt your synced notes. Policy and internal controls limit when that happens, but the capability exists.
• A valid legal request can reach your notes. Apple publishes transparency reports on exactly this kind of demand.
• Your notes are one account takeover away. Anyone who gets into your Apple account can read every synced note from a browser.

So the honest default answer to "is Apple Notes private" is no, not in the strict sense. But unlike its competitors, Apple gives you two real ways to change that.

Way 1: Locked Notes (Per Note)

Lock a note and its body is encrypted with a key derived from your note password or, since iOS 16, your device passcode. Apple states it cannot access the content of a locked note. This is real, client-side protection, not a cosmetic password prompt, and it is more than Google Keep or Samsung Notes offers.

The caveats matter:

• The title stays visible. A locked note still shows its title and creation date in the notes list and in search. "Bank PINs" locked is still "Bank PINs" on screen.
• It is per note. Every note you do not explicitly lock stays in the Apple-holds-the-keys category. Nobody locks every note.
• Not everything can be locked. Some attachment types and shared notes are excluded.
• Forgotten password, lost notes. If you use a separate note password and forget it, Apple cannot recover the content. That is the honest cost of Apple not holding the key.

Way 2: Advanced Data Protection (The Whole Library)

Advanced Data Protection (ADP), added in iOS 16.2 in December 2022, is the bigger switch. Turn it on and iCloud Notes joins the end-to-end encrypted category: only your trusted devices hold the keys, and Apple cannot read any of your notes, locked or not.

Again, the fine print is where the privacy actually lives:

• It is off by default. Apple estimates most users never touch it. If you have not deliberately enabled it in Settings, you do not have it.
• Recovery becomes your problem. You must set up a recovery contact or recovery key. Lose both and your iCloud data is unrecoverable, by design.
• Shared notes are excluded. Collaboration requires server-side access, so shared notes do not get end-to-end protection.
• Not available everywhere. In February 2025 Apple withdrew ADP for new UK users after a government demand for access, a useful reminder that cloud encryption ultimately lives inside whatever law applies to the vendor.

What This Looks Like Side by Side

Privacy question	Apple Notes (default)	Apple Notes (locked / ADP)	Scrib
End-to-end encrypted?	No	Yes (with caveats)	Yes, on-device
Who holds the key	Apple	You	You
Account required	Apple ID	Apple ID	None
Titles hidden when locked	n/a	No, titles stay visible	Yes, vault hides notes
Works on Windows	Browser only	Browser only	Yes, native (Scrib Desktop)
Works on Android	No	No	Yes, native

The Gaps People Miss

Gap 1: the default is the product. Apple's end-to-end options are genuinely good, and almost nobody uses them. If you have never opened Settings and enabled ADP, or never long-pressed a note to lock it, your notes sit in the same vendor-readable category as everyone else's.

Gap 2: "On My iPhone" notes are local, not protected. You can keep an account that never syncs to iCloud (Settings, Notes, "On My iPhone" account). Those notes never reach Apple, which is good, but they are also not encrypted beyond normal device storage and they die with the device. Local is not the same as locked.

Gap 3: passwords do not belong here. People ask "is Apple Notes safe for passwords" thousands of times a month. Apple's answer and mine agree for once: no. Apple ships a dedicated Passwords app with breach monitoring and autofill. A locked note has none of that. For anything with a login, use a real password manager like Bitwarden.

Verdict

If you are all-in on Apple hardware: Apple Notes with ADP enabled and sensitive notes locked is the strongest preinstalled option from any major vendor. Turn ADP on, set a recovery key, and it is legitimately private. That is not a sentence I can write about Samsung Notes or Google Keep.

If you left everything on defaults: your notes are encrypted with Apple's keys, not yours, and the answer to "is Apple Notes private" is no. Ten minutes in Settings changes that. Do it.

If your life includes a Windows PC or an Android phone: Apple Notes stops at the browser. For notes that stay private on those platforms, you want encryption that lives on the device itself. That is the entire design of Scrib on Android (AES-256, key in the Android Keystore, no account, no network permissions) and Scrib Desktop on Windows (open source, AES-256 encrypted files, portable). Neither has a cloud to subpoena.

Common Questions

Is Apple Notes end-to-end encrypted?

Not by default. Standard iCloud notes are encrypted in transit and on Apple's servers, but Apple holds the decryption keys. Two features change that: locked notes, which encrypt an individual note so Apple cannot read its body, and Advanced Data Protection, an opt-in iCloud setting that extends end-to-end encryption to your whole Notes library on iOS 16.2 and later.

Can Apple read my notes?

For standard iCloud notes, yes, technically. Apple holds the keys, so it can decrypt synced notes and can be compelled to produce them in response to a valid legal request. Apple cannot read the body of a locked note, and it cannot read any note if you have Advanced Data Protection turned on.

Are locked notes on iPhone actually secure?

The note body is genuinely encrypted with a key derived from your password or device passcode, and Apple states it cannot access it. Two caveats: the note title stays visible in the notes list even when locked, and some content types cannot be locked at all. Lock protection is per note, so everything you do not lock stays readable to Apple by default.

Does Advanced Data Protection cover Apple Notes?

Yes. Advanced Data Protection extends end-to-end encryption to iCloud Notes, so only your trusted devices hold the keys. It is opt-in, requires iOS 16.2 or later on all your devices, makes you responsible for account recovery, and shared or collaborative notes do not get the same protection. Apple also withdrew the feature for new UK users in February 2025 after a government demand.

Is Apple Notes safe for passwords?

No, and Apple itself points you to its Passwords app instead. Even a locked note is a workaround, not a password manager: no breach alerts, no autofill, no per-site encryption records. Use a dedicated password manager for credentials and keep notes apps for notes.

Can I use Apple Notes on Windows or Android?

Only through a browser at icloud.com. There is no native Apple Notes app for Windows or Android. If you take private notes on a Windows PC, a local encrypted editor such as Scrib Desktop keeps them off every cloud, and on Android the Scrib app encrypts notes on the device with no account at all.

Keep Reading

• Notes App Encryption at Rest: What It Protects and What It Does Not: the difference between "encrypted" and "private", explained properly
• Is OneNote Safe?: the same audit applied to Microsoft's notes app
• Best Private Notes Apps for Windows: for the PC that sits next to your iPhone
• Best Private Notes Apps for Android: if you are switching platforms, start here