Passwords do not belong in your camera roll.

Use the right search

First: Passwords app or Photos?

If you are looking for a password already saved by iPhone AutoFill, open Apple's Passwords app. It organizes website passwords, app passwords, passkeys, verification codes, and Wi-Fi passwords. SecretScan does not replace that app or reveal its protected records.

This guide is for a different problem: a password or passcode visible inside a screenshot, camera photo, scanned note, chat image, or other item stored in Photos.

Search for known password images with Photos

1. Open Photos, then tap Search.
2. Try visible context you remember: the website or app name, account email, domain, password, passcode, login, credentials, or Wi-Fi.
3. Open likely results and use Live Text to confirm what the image actually contains.
4. Repeat inside the Screenshots collection when you want a narrower review.

Apple says Photos can search text visible in images, including email addresses and phone numbers. This works best when you know what to type. It is not a guarantee that every photographed password will be found: the useful value may have no label, OCR can miss text, and ordinary help screens may also contain the word “password.”

Scan when you do not remember the exact words

SecretScan uses Apple's on-device OCR plus deterministic checks for likely password or passcode labels and plausible adjacent values. It ranks candidates for you to inspect; it does not upload Photos or extracted text to SecretScan servers.

Detection can miss content and can produce false positives. A login-help screenshot may look suspicious, while a real password with no recognizable context may be missed. Treat the scan as a focused first pass, then review the image yourself.

Clean up in the right order

1. Preserve access safely. Before deleting the only usable copy, save the account credential in Apple's Passwords app or another password manager you trust, then verify that it works.
2. Change it if exposure is possible. If another person, service, shared album, message, ticket, or backup may have received the image, change the password through the issuing website or app. Deleting the photo does not invalidate it.
3. Delete obsolete image copies. Remove the original from Photos after you no longer need it. With iCloud Photos, deletion applies to devices signed in to the same Apple Account.
4. Review Recently Deleted. Apple keeps deleted photos there for 30 days unless you permanently remove them sooner. Do that only after you are certain the needed credential is stored safely.

Hiding a photo moves it to the locked Hidden collection; it does not remove the password image from Photos or revoke the password.

If you already shared the screenshot

Start with the credential, not the picture. Use the issuing service to change or revoke the password, review the destination where the image traveled, then remove copies you control. The free sensitive screenshot exposure check can put those actions in order without asking for the password or the image.

Continue the camera-roll audit

Passwords are only one access category. Review recovery codes and seed phrases, API keys and tokens, and the complete sensitive-screenshot checklist.