Encrypted photo storage: who holds the key?
Nearly every place you can keep photos encrypts them. That word alone tells you very little. What matters is who holds the key. If the company holds it, the company can open your photos, and so can anyone who gets into the company. If only you hold it, nobody else can, and nobody can reset it for you either.
Three kinds of "encrypted"
Encrypted in transit means the photo is scrambled on its way to the server. Every serious service does this. It protects the trip, not the storage.
Encrypted at rest means the files are encrypted on the company's disks, with keys the company keeps. It protects against a stolen hard drive. It doesn't protect against the company, a court order, or a hacked account.
End-to-end encrypted means the photo is encrypted on your device with a key the company never sees. The server only ever holds scrambled files.
iCloud Photos
By default, iCloud Photos is encrypted in transit and at rest, and Apple keeps the keys. That's what lets Apple help you recover your account and lets you open your library at iCloud.com.
Turn on Advanced Data Protection and iCloud Photos becomes end-to-end encrypted. Apple no longer has the keys. You have to set up a recovery contact or a recovery key, because Apple can't help you get back in. Shared Albums stay outside it. Either way, the Hidden album is part of the same library and syncs to every device on your Apple Account.
Google Photos
Encrypted in transit and at rest, with Google holding the keys. Google scans and indexes your library to power search and Memories. It's convenient, and it's the opposite of private.
End-to-end encrypted clouds
A few services, Ente and Proton Drive among them, encrypt photos on your device before they upload. You get a cloud copy on every device, and the company can't see it. You still depend on an account, a company staying in business, and a password you can't afford to lose.
On the phone only
A vault app that encrypts on the phone and never uploads takes the server out of the picture. Mavaul works this way. Every photo, video and thumbnail is encrypted with AES-256-GCM on the iPhone, with a random 256-bit key made on the phone. Your passcode, stretched with PBKDF2, locks that key. There's no account and no Mavaul cloud, so there's nothing on our side to open, hack or hand over.
The trade is that the phone holds the only copy until you make another one. Mavaul's encrypted backup (Premium) writes the vault to your own Dropbox, Nextcloud or Files, already encrypted. Dropbox stores the files and can't read them.
Which one to use
For your everyday library of thousands of photos, iCloud with Advanced Data Protection is a strong default, if you're comfortable managing its recovery key.
For the photos you'd never want on a server, or on the family iPad, or at iCloud.com, keep them on the phone in a vault with its own passcode. Then take them out of Photos, so they aren't in iCloud too. Move photos into a vault without leaving copies has the checklist.
Whatever you choose, ask the same question: if I forget my password, can the company get my photos back? If the answer is yes, the company can open them.
Questions
Is iCloud end-to-end encrypted?
Only with Advanced Data Protection turned on. By default, Apple holds the keys to iCloud Photos.
Is AES-256 enough?
Yes. The weak point is almost never the cipher. It's who holds the key and how good the passcode protecting it is.
Can I use both a cloud and a vault?
Yes, and most people should. Keep the everyday library in the cloud and the private photos in the vault, with an encrypted backup you control.