What is a decoy vault? How to set one up that’s believable

A decoy vault is the version of your private stuff that you can afford to show. Type one code and a vault opens with photos and notes that look personal enough to be worth locking. Type a different code and your real vault opens instead.

The idea is simple. Making it convincing is not: an empty or obviously staged decoy gives the game away faster than having no decoy at all. This guide covers what the term means, where it comes from, how to stock and use a decoy so it holds up, and the situations where it won’t help you.

What “decoy vault” means, and where the idea comes from

In a vault app that supports it, you set two codes. The real code opens your real vault. The decoy code opens a second, separate vault with its own photos, notes and files. Some apps call this a fake PIN or a decoy password; the idea is the same. In a calculator vault, both codes are typed into the calculator, so from the outside they look identical.

The goal is plausible deniability. You can open the app when asked, the other person sees a vault with believable contents, and nothing on the screen tells them there’s a second one. It does not hide the fact that you have a vault app. It gives you a reasonable answer to “what’s in there?” that isn’t the whole answer.

The idea is older than phone vaults; disk encryption got there first. The open-source tool VeraCrypt supports a hidden volume: a second encrypted volume tucked inside the free space of another one. One password opens the outer volume, another opens the hidden one, and VeraCrypt’s documentation says it should be impossible to prove the hidden volume exists, provided you follow its precautions. The same page gives the advice most phone-vault guides skip: put sensitive-looking files that you don’t really need to hide in the outer volume. That is the whole craft of a decoy.

A related idea is the duress code. Alarm systems have long had a code that seems to disarm the alarm while quietly alerting the monitoring company. On phones, the Android-based GrapheneOS offers a duress PIN that irreversibly wipes the device when entered. A decoy vault is the gentlest of the three: it doesn’t destroy anything or call anyone. It just opens a different room.

How your two codes should differ

The codes matter as much as what’s behind them. A few rules make the difference:

• Make them unrelated. Not 4471 and 4472, not one code reversed, not the same digits with one added on the end. If someone learns one code, the other shouldn’t follow from it.
• Make them the same length. If someone has watched you type a six-digit code before, seeing you type four digits today is a tell.
• Keep both away from your other numbers. Not your phone passcode, your bank PIN, a birthday or an anniversary. Anyone who knows your phone passcode will try it first.
• Treat the decoy as the public one. It is the code you type when people are around, so assume it will be seen. Type the real code only when nobody can see the screen.
• Practise both. Hesitating, or getting the decoy wrong under pressure, gives more away than any content could. Keep a copy of the real code somewhere that isn’t your phone, because a vault with proper encryption has no way back in if you forget your calculator vault password.

How to stock a decoy so it’s believable

When someone opens your decoy, the question in their head is “is this what they were hiding?” The decoy has to answer yes. That means content that is mildly private, a bit boring, and consistent with the life they already know you have.

What to put in it

• Real photos from your own camera roll. Screenshots of a gift you’re planning, photos for a surprise, selfies you’d rather nobody scrolled past, a receipt for something you don’t feel like explaining twice. Things that are worth locking but not worth a fight.
• Photos spread across time. Pick shots from different months and seasons, not thirty pictures from one afternoon. Photos taken on your phone carry the date they were taken, and a set that all comes from the same day looks like what it is.
• A note or two. A gift list, a half-written message you never sent, a budget. Notes make a vault feel used.
• A reasonable amount. The amount should fit how long you’ve had the app. Bear in mind that Settings › General › iPhone Storage on iPhone, and the app’s storage page under Settings › Apps on Android, show how much space each app uses. If the decoy holds a dozen photos and the app takes up several gigabytes, a curious person may wonder where the rest is.

What to keep out

• Anything you’d be hurt to have seen. The decoy exists to be seen.
• Anything that points at the real vault: the same album names, other photos from the same event, a note that mentions what you’re actually protecting.
• Other people’s private things, such as screenshots of a friend’s messages.
• Stock images, memes saved in bulk, or nothing at all. An empty decoy is the worst option, because it looks either unused (so why install a vault?) or recently emptied (so what did you remove?).

Keep using it

A decoy frozen in time ages badly. If the newest thing in it is eight months old and you obviously use the app, that doesn’t add up. Every couple of weeks, drop something new into it. When you open your vault in front of people, open the decoy, so it becomes the vault they’ve seen you use.

Close the gaps around your real vault

A decoy is pointless if the real content is still lying around elsewhere on the phone. After you move something into your real vault, check the places it might still be:

• The camera roll. Delete the originals. On iPhone, deleted photos then sit in Recently Deleted for 30 days before they’re removed for good, so empty that too.
• The cloud. Google Photos keeps deleted items in its trash for 30 days, and if backup is on, deleting removes the backed-up copy and the same item on your other devices. With iCloud Photos, a deleted photo leaves iCloud and your other devices once it’s gone from Recently Deleted. Check the trash wherever your photos sync.
• Messaging apps. Some save received photos to your gallery or keep their own media folders. A photo you hid can still be sitting in a chat.
• Shared albums and shared libraries. If other people can see an album, they can see what’s in it regardless of what you do on your phone.

When a decoy vault won’t help

A decoy is a social tool. It works on people who look at the screen and accept what they see. It doesn’t change what is stored on the phone, and it doesn’t change what someone already knows.

Someone who knows the app. Decoys are not a secret: we describe ours in the Calculator Locker security overview, and anyone who looks up a vault app can learn whether it offers one. Plausible deniability doesn’t depend on nobody knowing decoys exist, only on nobody being able to tell from the screen which vault they’re looking at. But a determined person can simply keep asking. A decoy gives you a believable answer; it doesn’t end the argument. If you’re worried someone will go looking for the app itself, our guide on how to tell if a calculator app is fake shows exactly what they would check.

Forensic tools. Phone forensics looks at storage directly, file by file. A decoy is a front door, not a wall. No vault app can honestly promise that a forensic examiner won’t find signs of a second vault, and you should be wary of any that does. Our checklist for whether calculator vault apps are safe covers what encryption actually protects.

Legal demands. Some countries can legally require you to hand over passwords, and giving an official a false one can be an offence in itself. A decoy is meant for privacy from the people around you: family, partners, friends, the colleague who borrows your phone. It is not meant for border checks, police or courts. If you’re facing one of those, speak to a lawyer.

If someone controls your phone

If a partner or family member checks your phone, demands your codes, tracks where you go or gets angry when you have privacy, a decoy can make things more dangerous. If they find a second vault, it reads as proof that you’ve been hiding something, and that can raise the risk to you.

Hidden apps can also be found. On iPhone, the names of hidden apps still show in Settings › Apps › Hidden Apps, Screen Time, Battery and App Store purchase history. On Android, the app list in Settings and the Play Store’s list of installed apps show what’s on the phone, disguised or not. Someone with regular access to your phone may also have installed monitoring software. NNEDV’s Safety Net project notes that some abusers escalate when that software is removed, and suggests talking to an advocate before you act and using a device they can’t get into, such as a friend’s phone or a library computer.

Decoy codes in Calculator Locker

We build Calculator Locker, so here is how it handles this. Inside the vault, under Settings › Codes, locking and biometrics › Decoy code, you can add a second, decoy code. It opens a second, separate vault, one you’d happily show someone: fill it with holiday photos and hand the phone over. Your code can be any four to eight digits, and decoy codes are free, like the rest of the app.

The disguise does most of the work before a decoy is ever needed. On the home screen it is a working calculator, so most people never get as far as asking what’s inside. The decoy is the second layer, for the moment someone does. Everything above still applies: stock it with real, dated, slightly dull things, keep using it, and clear the camera roll behind your real vault. Calculator Locker can delete the originals from your camera roll in one tap when you import.

Two honest limits. Both vaults live only on your phone, with no account and no cloud, so if you lose the phone without an exported backup you lose the vault too. And if someone keeps trying codes, the break-in alert that photographs wrong attempts only covers the vault, not your phone’s lock screen.