How to make encrypted iMessage backups for your iPhone

If you want to learn how to make encrypted iMessage backups for your iPhone, you’ve come to the right place. In this guide, we’ll explain: 

• What is and isn’t encrypted in iMessages
• How to set up your own encrypted backups for iMessages
• How to erase old iCloud backups of your iMessages 

Why users are worried about encrypted iMessage backups

Earlier this month, journalists reported on a 2020 drug trafficking investigation in which law enforcement accessed the suspects’ iCloud accounts. The police got a search warrant, and then forced Apple to hand over the iMessages of the suspected drug dealers. The evidence from their chats led to a number of arrests.

The story surprised many iPhone users, and left them with more questions than answers: Aren’t my iMessages protected by end-to-end encryption? Doesn’t Apple make encrypted iMessage backups for me automatically? 

Unfortunately, stories like this one can leave iPhone users feeling confused about how encryption actually works on their devices. And when it comes to iMessages, there’s often quite a bit of misunderstanding about what’s encrypted … and what isn’t. Let’s take a closer look.

How encryption works on iOS and in iMessages

Here’s the summary version of how encryption works on an iPhone, and in iMessages:

• On an iPhone, all user data on the device is protected by strong encryption. As long as your device has a good passcode, it’s almost impossible for someone to break into it. In addition, you can set up your iPhone to automatically delete itself after 10 failed login attempts. This prevents someone from brute-forcing the device — a fact which has led to legal clashes between Apple and the FBI. 

• iMessage is an end-to-end encrypted (E2EE) messenger, though only when it’s communicating with another iMessage app. For all practical purposes, it’s not possible for anyone (even Apple) to decrypt iMessages. This is because only you and the person you’re chatting with have the encryption keys required to decrypt those messages. Note that if you’re using iMessage to talk to someone on an Android device, your chats are not E2EE. However, the level of encryption is still quite strong. (Check out this article for more info about how E2EE messaging apps work).

• iMessages are backed up to iCloud by default, and so this is how things tend to be set up on most people’s iPhones. But while iCloud iMessage backups are encrypted, they aren’t end-to-end encrypted. This means Apple has the encryption key needed to decrypt the iMessages stored in iCloud. And that is how they can give law enforcement access to users’ iMessages.

Why doesn’t Apple just use E2EE for everything?

So why doesn’t Apple simply end-to-end encrypt all of the data that gets backed up in iCloud? There are a couple of answers.

First of all, there has been some speculation that it’s a direct concession to the FBI. The feds have specifically asked Apple not to enable E2EE for messages and other types of data backed up in iCloud. Some people think that the lack of end-to-end encryption on iMessage backups is a compromise with law enforcement.

But Apple’s official position on the matter has more to do with the end user. Basically, people want to be able to use iCloud to recover lost data. And they want Apple to be able to help them if they ever forget their password or recovery key. If Apple turned on E2EE for everything stored in iCloud, this would mean two things. On the one hand, they couldn’t give the police access to an iCloud account. But on the other hand, they also wouldn’t be able to help users who’d lost access to crucial backups because of a forgotten password. From Apple’s point of view, this is one of those times when usability is more important than absolute security.

Should you stop backing up your iMessages to iCloud?

Short answer? It’s a personal choice, and it’s definitely a trade-off. Here’s what you’ll need to think about:

We’re going to go out on a limb here and assume that none of our readers is involved in illegal activity. This means that there’s almost no chance of the government ever asking Apple to see copies of iMessage chats that you’ve backed up to iCloud. So for most people, the risk of “big brother” looking at your private messages is actually pretty low.

But if you decide to stop using iCloud to back up your iMessages, you’ll definitely sacrifice some convenience. If you ever need to restore your device, you’ll have to do it manually from a local backup (we’ll talk about how to make those below). And if you somehow lose the password for your encrypted backup, you’re out of luck: Apple won’t be able to help you recover the lost data.

Still, many privacy-conscious users are uncomfortable with the thought that Apple has a way to access their private messages — and that the authorities could one day force them to hand those messages over. If that describes you, the next section explains how to set up your own system of backups for your iPhone’s iMessages.

How to create your own encrypted iMessage backups for an iPhone 

Here’s what you should do if you want to keep backups of your iMessages that Apple can’t access:

First, you’ll need to turn off the default “backup to iCloud” method on your device:

1. Go to Settings > [Your Name] > iCloud. This is where you can see all the apps that use iCloud to back themselves up, and where you can turn off iCloud backups for iMessages (and any other app you don’t want backing up to iCloud). To turn off backups for iMessages, just find iMessages and set the toggle switch to Off. Note that there are some types of data that are backed up to iCloud using E2EE! This includes things like iCloud Keychain data, Apple Card data, and Health data, and more. For a complete list of iCloud data protected by E2EE, see Apple’s support page.

Next, you’ll need to actually back up your iPhone to your Mac (there is also an iPhone backup method for Windows users, but it requires iTunes). Here’s how to do it:

2. Connect your iPhone to your Mac with a USB. 

3. Use Finder to locate your iPhone. Go to the top of the Finder window and click General > Back up all of the data on your iPhone to this Mac. 

4. Check the box that says Encrypt local backup to create an encrypted backup file. This will require setting a password for the iPhone backup that’s stored on your Mac, and this password is the only way to access the backup, so don’t lose that password! Click Back Up Now to make your first backup. If you ever need to restore your iMessages to a new device, you can do so using this encrypted backup.

5. Remember that since this is a manual process, you’ll have to create new, up-to-date backups from time to time. You may want to set a calendar reminder to do this once a week or once a month.

How to delete older, unencrypted iMessage backups

If you follow the steps above, you’ll be able to keep secure, reasonably current iMessage backups for any conversations you have on your iPhone. But what if you’ve been using the default iCloud backup method? If so, there are still Apple-accessible backups of those conversations in iCloud.

To delete these, go to Settings > [my name] > iCloud > Manage Storage > Backups. Select any old backups that you want to delete, and then click Delete Backup.

To learn more about encryption options for your Mac, check out this article on Open Firmware Password Protection, and be sure to read the FileVault entry in this macOS Big Sur setup guide.