iPhone passwords vs a vault app
The iPhone's Passwords app holds logins, passkeys and verification codes. A vault app holds files: photos, videos, scans and PDFs. They do not replace each other. Put logins in the password manager and documents in a vault, and keep any printed recovery codes on paper, with a scan in the vault if you want a second copy.
What the Passwords app is for
Apple describes the Passwords app as the place where your account passwords, passkeys, Wi-Fi passwords and verification codes live together, available from iOS 18. It can generate the six-digit codes used for two-factor sign-in, so you do not need a separate authenticator app for sites that allow it. Syncing across your Apple devices needs the same Apple Account with Passwords and Keychain turned on in iCloud settings, and Apple says passkeys are encrypted and stored in iCloud Keychain. Opening the app asks for Face ID, Touch ID or your passcode.
So the Passwords app answers one question well: how do I sign in without remembering fifty secrets? It is not built to hold a scan of your passport.
What a vault app is for
A vault app stores files behind its own lock. For documents that means a passport scan, a tax return, a medical letter, a photo of a card you cannot replace. These are not secrets you type; they are things you show. A vault gives them a separate credential and encryption, and a way out.
Where each thing belongs
| What you have | Better place | Why |
|---|---|---|
| Website logins and passkeys | Passwords app | Built for sign-in, fills them in |
| Two-factor codes you use daily | Passwords app, or an authenticator | Needs to be quick |
| Printed recovery codes | Paper, kept apart, with a scan in a vault | Recovery codes are your way back in if the phone is lost |
| A scan of a passport or ID | Vault | A file, not a login |
| A seed phrase for a crypto wallet | Paper first | See the caution below |
| Photos of private documents | Vault | Many files, folders, original files kept |
The recovery-code problem
Two-factor recovery codes exist for the day you lose your phone. If the only copy sits in an app on that phone, it is lost with it. If it is in an account that needs the lost phone to open, it is out of reach exactly when you need it.
So keep a printed copy somewhere safe, apart from the phone. A scan in a vault is a convenient second copy for the days you need to check a code, but it is not the first copy, because a vault that lives only on the phone goes with the phone. With StrongRoom, the way to make that second copy survive is an Export Package, kept somewhere other than the phone. Export Package: your Vault as one encrypted file
We did not verify whether the Passwords app can store recovery codes in an entry, so we do not recommend a place for them inside it. Check that on your own phone.
Two different ways to lose things
Apple says the Passwords app syncs across your devices through your Apple Account, so a lost phone does not have to mean lost logins. A vault that has no copy in the cloud has the opposite property: nothing about it is reachable from anywhere else, but it is lost with the phone unless you export it. Neither is better; they fit different things. Local-only or cloud-backup vault?
What not to do
- Do not keep a seed phrase as a photo in your photo library.
- Do not keep recovery codes only in a note on the phone you would lose.
- Do not treat a vault as a password manager. It will not fill logins, and a login typed in by hand every time defeats the point.
What StrongRoom is, and is not
StrongRoom stores files, not logins, and has no notes. Each item has its own key, and it works with no account. It cannot restore on a new phone from a pattern alone: it needs an Export Package plus the 12-word Recovery Phrase. No outside expert has checked the app yet. What StrongRoom does not protect against
For the checklist for choosing a vault, see the pillar. -> /guides/choosing-a-vault-app/how-to-choose-a-photo-vault-app/ For a similar comparison with locked notes, see the notes guide. -> /guides/choosing-a-vault-app/notes-lock-vs-vault-app/ For what happens if you lose a credential, see the answer. I forgot my photo vault password. What can I do?
Frequently asked questions
Is the Passwords app a vault?
It is a password manager for logins, passkeys and verification codes. It is not built to hold files.
Where should I keep 2FA recovery codes?
Print them and keep them somewhere safe, apart from the phone. A scan in a vault can be a second copy.
Can I store passwords in StrongRoom?
You can store a file, such as a scan, but StrongRoom does not fill logins and has no notes.
Do I need both?
Most people benefit from both: logins in a password manager, documents in a vault.
Sources
- Use the Passwords app to create, manage, and share passwords and passkeys across Apple devices (Apple Support), checked on 2026-10-30.
- Use passkeys to sign in to websites and apps on iPhone (Apple Support), checked on 2026-10-30.
- Automatically fill in one-time verification codes on iPhone (Apple Support), checked on 2026-10-30.