How to store sensitive personal photos securely in the cloud

Start by separating, not by encrypting Most people try to secure everything and abandon the project. The workable approach is triage. Sort your library into three buckets:

• Public-ish — holidays, food, pets, screenshots. Mainstream cloud is fine.
• Personal — family, home, children, day-to-day life. Prefer encrypted storage.
• Sensitive — private albums, medical images, document and ID scans, financial paperwork, anything shared in confidence. Encrypted storage only.

The third bucket is usually under 5% of a library and carries almost all of the risk.

Step 1 — Turn off automatic backup for the sensitive source If sensitive images come straight from your camera roll, automatic upload puts them in a readable cloud before you decide anything. Disable it for that service, or move the images out of the camera roll promptly after capture.

Step 2 — Encrypt before upload, not after "Encrypted at rest" on the provider's disks does not help you here. What matters is that the file is sealed on your device with a key derived from your passphrase. Look for a documented memory-hard KDF (Argon2id) and an authenticated cipher (XChaCha20-Poly1305).

Step 3 — Treat metadata as content Rename nothing helpfully. Better: choose a service that encrypts file names, album names and EXIF automatically, so you do not have to. Strip GPS from anything you will ever share outside the vault.

Step 4 — Share with a fuse, never with a permanent link When you must send a private photo:

• use a link whose key material lives in the URL fragment, which browsers never send to the server
• add a passphrase, delivered through a different channel than the link
• set the shortest possible expiry — DRIVUNO caps every public link at 24 hours
• cap the view count and revoke as soon as it has been received

Never send sensitive media through a channel that keeps a readable copy indefinitely.

Step 5 — Plan recovery before you need it Zero-knowledge means no provider-side reset. Before you migrate anything:

• generate the recovery kit and store it offline — printed, in a safe or a sealed envelope
• consider a second copy in a different physical location
• verify it once, on purpose, so you know the procedure works

Step 6 — Keep one offline copy Encryption protects confidentiality, not availability. An encrypted external drive kept at another address covers fire, theft and account loss. Two copies, one off-site, is the minimum for anything irreplaceable.

Step 7 — Clean up the old location Delete the originals from the mainstream service **and** empty its trash, where deleted items typically remain recoverable for a period. Check for a second copy in a desktop sync folder.

Step 8 — Lock the device itself A perfect vault behind an unlocked phone is theatre. Use a strong device passcode, biometric unlock, an app-level PIN on the vault, and a short auto-lock timeout. Enable two-factor authentication or a passkey on the account.

A note on tone and reality None of this requires paranoia. It is the digital version of not leaving personal documents on the kitchen table when strangers visit. Ten minutes of setup, once.