Is it safe to keep a photo of my seed phrase or backup codes on my phone?

When a crypto wallet showed you 12 or 24 words, the fastest thing to do was take a screenshot. Same with the backup codes for your Google account, or the recovery codes from a bank app. Now those words sit in your camera roll, next to holiday photos, and in the cloud. This page explains what that copy exposes, where wallet makers and Google say to keep these codes, and where York Vault fits. We checked each fact against MetaMask’s, Google’s and Apple’s own pages on 2026-10-08.

Why the camera roll is the wrong place

A seed phrase is not like other secrets. MetaMask says “Anyone who can access your SRP can control your funds”, and that “MetaMask cannot recover your wallet if access is lost.” There is no reset and no support line that can undo a theft.

A screenshot of it travels:

• To the cloud. Apple says iCloud Photos “keeps every photo and video you take in iCloud, so you can access your library from any device.” Google Photos says the same for backed up photos. So the phrase is only as safe as your Apple Account or Google password. Our page on an ex who knows your account password shows how far that reaches.
• To every synced device. A family iPad, a work laptop or an old phone still signed in can show it.
• Behind your passcode. Anyone who opens your phone can open Photos. The Hidden album helps against a glance, but on iPhone it opens with Face ID, Touch ID or the passcode, and Apple says hidden photos sync to your other devices too.

The same is true of account backup codes. Google says “Do not share your backup codes with anyone.” A screenshot in a shared cloud is close to sharing.

Crypto seed phrases: paper, offline

Wallet makers agree on the basics. MetaMask’s advice:

1. Write it down by hand. “The importance of handwriting your Secret Recovery Phrase is that it cannot be stolen online.”
2. Check it. “Double-check your spelling and that you wrote down every word in the same order they were given.”
3. Keep it offline. MetaMask lists “Store your SRP somewhere secure and offline” among its security tips.
4. Do not keep it in “an easily hacked location, like a cloud-saved document or an email titled ‘Secret Recovery Phrase’.”
5. Never give it to anyone, “even if they say they’re from MetaMask Support.”

For a wallet with a large balance, MetaMask also says to consider a hardware wallet. Follow your own wallet maker’s steps if they differ from these.

Account backup codes: a printed copy

Backup codes for your Google account are a smaller risk, because they work only with your password. Google says:

1. Open your Google Account, tap Security & sign-in, then 2-Step Verification, then Backup codes.
2. Print them, or download them. Google suggests you keep a printed copy “where you keep your passport or other important documents.”
3. Each code works once. If you lose them or think they were stolen, tap Refresh for a new set of 10. The old set stops working.

For backup codes from a bank, an email provider or a social app, do the same: print or write them down, and keep them with your important papers.

If a copy is already in the cloud

1. Delete every screenshot or photo of the phrase or codes.
2. Empty Recently Deleted on iPhone, with our Recently Deleted guide, or the trash in Google Photos.
3. For backup codes, make a new set. The old ones then stop working.
4. For a seed phrase, treat it as exposed. Ask your wallet maker how to move your funds to a new wallet with a new phrase. Do not ask strangers, and ignore anyone who contacts you to offer help.

If you used iCloud with standard data protection, Apple holds the keys to your photos. Our iCloud Photos encryption guide explains what changes with Advanced Data Protection.

Where York Vault fits

For a seed phrase that controls real money, the honest answer is paper, offline, as above. York Vault is a phone app. It is far safer than the camera roll, but it is not offline storage.

For the many codes that are not seed phrases, York Vault is a good second place, behind its own code:

• Encrypted notes. Type backup codes into an encrypted note, inside an album. Notes are free. See notes and voice notes.
• Cards and documents. Keep scans of cards and documents in one place, and away from your photos. See IDs and cards.
• A second lock. An album code gives one album its own key, so the main code alone cannot open it.
• Out of search and Siri. York Vault adds nothing to Spotlight or Siri suggestions, and on iPhone it shows a plain cover in the app switcher.
• An encrypted backup. The free backup goes to your own iCloud or Google Drive as encrypted chunks with random names. iCloud and Google see no file names or contents. See encrypted backup.

When you add a screenshot to York Vault, remove the original from Photos and empty Recently Deleted, or the copy you meant to protect stays in the cloud. The import and cleanup page shows each step.

One code York Vault cannot keep for you

York Vault has its own 12-word recovery key. It opens your library if you forget your code, and we keep no copy. So treat it like a seed phrase: write it on paper and keep it with your passport or other documents. Do not keep a photo of it on the same phone. The recovery key page and the help page on where to keep it cover the details.