Pictures of passwords and Wi-Fi details
Why people do it
A screenshot is quick. You're at a friend's, you need the Wi-Fi code, so you snap the router label. Or you photograph a page of logins "just in case". It works, until the picture is somewhere you didn't mean it to be.
Why it's risky
- It sits among your everyday pictures, where anyone with your phone, or your iCloud Photos, could see it.
- It doesn't warn you if it's weak or used twice. A manager can.
- A Wi-Fi password lets anyone who knows it join that network.
The UK's National Cyber Security Centre says that if you reuse a password and one account is compromised, a hacker can try the same password on your other accounts. It says the first and most important step is to turn on two-step verification.
Where to keep them instead
- A password manager. CISA, the US cyber agency, calls a password manager one of the easiest ways to protect your accounts, and advises a different strong password for each account. NCSC says a built-in browser or device manager is a safe place on your own devices.
- The Passwords app. Apple says it keeps your account passwords, passkeys, Wi-Fi passwords and verification codes in one place, and warns you about weak or reused ones. It's built into recent iPhones.
- For Wi-Fi, look it up when you need it. Apple says you can find a saved network's password in the Passwords app, share it with a nearby friend from your unlocked iPhone, or show a network QR code that friends can scan.
Please don't put a password in Apple's Notes app or a message to yourself. A password manager is built for this, and a note isn't.
If a picture was already seen
- Change the password. The FTC says to create a new strong password, and to change it anywhere else you used it. Then turn on two-factor authentication.
- For Wi-Fi, change the password in your router's settings if you shared it with someone you no longer trust. Your router's manual or provider can show how.
- Delete the picture. Deleted photos stay in Recently Deleted for 30 days, and with iCloud Photos on, deleting applies to all your devices. Empty Recently Deleted to remove it sooner.
- Check chats. If you sent the picture to anyone, their copy stays with them.
Changing a password is what makes an old picture useless. Deleting the picture alone doesn't. That's our advice.
How FirstHour helps
This is a place where FirstHour has limits, so here is the plain version. It doesn't look for account passwords in your pictures. A screenshot of a login page, or a photo of a page of passwords, isn't something it finds.
For Wi-Fi, Protect finds Wi-Fi QR codes that have the network's password inside, and shows them under Wi-Fi passwords. A picture of a router label or a typed-out code isn't found. It also finds QR codes that set up an authenticator app, and shows those with backup codes. Pictures stay blurred until you're ready, you can move any to the Vault, and nothing is uploaded.
It can miss handwriting and blurry pictures, and it doesn't check videos or your Hidden album. FirstHour can't change a password for you. Only the account can do that.
Questions
Can I keep the picture in the Vault?
That's safer than your camera roll, because the Vault opens with its own pattern or PIN, separate from your iPhone passcode. A password manager is still the better home for a password, because it can fill it in and warn you if it's weak.
Is a Wi-Fi password as important as an account password?
It matters less than your email or bank password, but anyone who has it can join your network. Change it if you've shared it widely.
What about codes from text messages?
Sources
- Use Strong Passwords, CISA
- Top tips for staying secure online: Managing your passwords, National Cyber Security Centre (UK)
- Use the Passwords app to create, manage, and share passwords and passkeys across Apple devices, Apple Support
- Find and share your Wi-Fi password on iPhone, Apple Support
- What To Do if You Were Scammed, Federal Trade Commission
- Delete or hide photos and videos on iPhone, Apple Support