I would like to know if iCloud uses client-side encryption i.e. all data is encrypted on client side and even Apple can't decrypt the data and read it.

Is this true for iCloud?

  • I don't know anything about iCloud technology in particular, but I don't see how a "cloud" service could use client-side encryption, without sacrificing usability. That would mean you'd need to copy/enter a private key (e.g., 256 bits) on every client they wanted to access the data from. (I think I can name only one service that goes that far.)
    – Ken
    Jul 30, 2012 at 15:58
  • @Ken SpiderOak claims to use client-side encryption. They have clients for OS X and iOS. But it's not as convenient to use as Dropbox of course.
    – gentmatt
    Jul 31, 2012 at 8:08
  • @Ken Provided the clients can be sophisticated enough to handle the encryption and key management it could be done. The only use case that this would restrict is server side rendered webview of your data as gentmatt mentions. Everything else could be done entirely client side.
    – Pradeep
    Jul 31, 2012 at 10:19
  • Pradeep: Yes, as I said, it can be done, but either the user has to enter an obnoxiously long key on every device (not fun), or the actual keys are stored on the server (not secure). Or perhaps by not actually using a decently long key length. You need the whole private key on each client that will access it (probably 256+ bits), and that means either the user gets it there manually, or the server knows it.
    – Ken
    Jul 31, 2012 at 23:03
  • Let's keep both - one is more about backups and the other clearly about how things work under the hood. Whether client side encryption is in use will be useful for selecting transport level encryption or other countermeasures for those who care about securing their data.
    – bmike
    Aug 14, 2012 at 19:32

1 Answer 1



Apple securely transmits and stores the data to the cloud by using secure tokens for authentication - as officially stated in the iCloud security and privacy overview1 and the iCloud design guide2.

Apple also states they they will "never provide encryption keys to any third parties", which of course is not entirely true due to the Patriot Act3.

ArsTechnica states that Apple holds a master encryption key4 and is able to unencrypt any personal data - i.e. also for government requests. "This includes contacts, notes, unencrypted e-mails, application preferences, Safari bookmarks, calendars, and reminders." The data is only encrypted during transit and again when stored on Apple's servers. This is a necessity if Apple wants to provide browser access to iCloud data.

The Electronic Frontier Foundation notes5 that Apple is not inclined to be transparent about government requests.

As far as I understand the concept of client-side encryption, it suggests that all encryption must happen by the client as keys are not stored on the server (zero-knowledge policy).

Because Apple encrypts the data itself on the server for browser access it must store a key. Hence this is no client-side encryption.

1 - http://support.apple.com/kb/HT4865
2 - https://developer.apple.com/library/.../iCloudDesignGuide
3 - http://en.wikipedia.org/wiki/Patriot_act
4 - http://arstechnica.com/...apple-holds-the-master-key.../
5 - https://www.eff.org/pages/who-has-your-back/

  • 1
    I believe this is correct about iCloud not encrypting things on the client side - but in a sense where the encryption is of far lesser concern for privacy and security than where the decryption key is stored. With iCloud and DropBox and most any commercial product, the keys are stored by the vendor (or an alternate key is capable of decrypting either one account or many accounts). Unless your service has no way to recover any data if you lose your password/key and has been designed to never store a key to your data, you are open to subpeona, warrantless and warrantful searches and human errors
    – bmike
    Aug 15, 2012 at 17:21
  • Knowing Apple, I would actually expect they do the encryption on the client side but keep your key or equivalent on their servers so they can assist you when you enroll your next device into iCloud so you don't have to manually copy keys onto each device for decryption/encryption.
    – bmike
    Aug 15, 2012 at 17:25
  • As a side note, it IS possible to have both browser access and client-side encryption. Browser is a client and cryptography can be implemented in JavaScript.
    – skalee
    Jan 13, 2019 at 2:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .