How to hide photos on Android (the honest way)

There are at least four built-in ways to "hide" a photo on Android. Most of them hide it from a glance - not from a person who picks up your phone and starts looking. Here's what each option really does, and how to make private photos actually private.

First: "hidden" and "encrypted" are not the same thing

This is the whole game, so it's worth 20 seconds. Hiding a photo means it stops showing up in your main gallery grid. The file itself is still sitting on your phone, fully readable - any file manager, any USB connection, any other gallery app can usually open it.

Encrypting a photo means the file is scrambled with a key. Without the key, it's useless noise - even to someone who copies it off your device. If you only hide, you're relying on no one looking harder. If you encrypt, you don't have to.

Keep that distinction in mind as we go through the options.

Option 1 - The gallery's "hide" / "archive" feature

Most phone galleries (Samsung, Xiaomi, Google Photos "Archive") let you move a photo out of the main view with a tap.

• Good for: decluttering - keeping a screenshot or receipt out of the way.
• Not good for: privacy. The photo is unencrypted, and anyone who opens the "Archive," "Hidden," or "Recently deleted" folder sees it instantly. No lock, no key.

Option 2 - A .nomedia file or renamed folder

An old trick: create a folder, drop an empty file named .nomedia inside, and galleries skip it. Or rename the folder to start with a dot.

• Good for: hiding media from automatic gallery scanning.
• Not good for: anyone with a file manager. Toggle "show hidden files" and it's all there, unencrypted. This hides from software, not from people.

Option 3 - Secure Folder / Private Space

Samsung's Secure Folder and Android 15's Private Space create a separate, lock-protected area of the phone. This is a real step up - it's a genuine locked container, and on Samsung it's hardware-backed.

• Good for: a second locked space on supported phones.
• Watch out for: availability (not every phone has it), and the fact that the existence of the secure area is visible. Someone looking at your phone sees there's a locked space - which is sometimes exactly what you don't want.

Option 4 - Google Photos Locked Folder

Locked Folder keeps photos out of your main library and your backups, behind your screen lock. It's convenient and built in.

But it's tied to your device screen lock, it lives inside an app you've already unlocked when your phone is unlocked, and it doesn't give you a separate key or a decoy. We break this down in detail here: Umbra vs Google Photos Locked Folder.

Option 5 - A proper encrypted vault (what we recommend)

A vault app is the only option on this list that actually encrypts. When you move a photo into Umbra:

1. The file is encrypted with AES-256-GCM as it enters the vault.
2. The key is derived from your pattern - it isn't stored anywhere in readable form.
3. The original leaves your normal gallery, so it no longer shows up anywhere else.

Copy that file off the phone and it's unreadable. Open a file manager and you get ciphertext. That's the difference between "out of sight" and "out of reach."

Why "no internet permission" matters here

The safest data is data that physically can't travel. Umbra doesn't request internet permission at all - so there's no upload, no sync, and no server that could ever be breached. Your vault stays on your device, full stop.

What about being forced to open it?

This is the scenario most "hidden folder" tools ignore. If someone demands you open the app, Umbra lets you set a decoy pattern that opens a harmless vault, while your real one stays sealed and invisible. You can hand over the phone without handing over everything.

Quick comparison

The short answer

If you just want to tidy your gallery, the built-in hide feature is fine. If you have photos or videos you genuinely don't want another person to open - a partner, a kid, a thief, a border check - hiding isn't enough. Encrypt them, keep the key as something only you know, and make sure there's no copy syncing to a cloud you don't control.