Decoy vaults: what they fool and what they don't
Updated · By THEORIST LLC, the company that makes Hushtrove
A decoy vault is a second passcode that opens a different, harmless vault in the same app. It works against someone looking through your phone who doesn't know the app well: they see a believable vault and move on. It doesn't fool someone who knows decoys exist (vault apps advertise them on their App Store pages), it can't hide how much storage the app uses in Settings S1, and it isn't designed to stand up to forensic analysis of the iPhone.
How decoy vaults work
You set two passcodes. One opens your real vault; the other opens a separate vault you fill with ordinary photos. Private Photo Vault describes its version as a decoy password that "opens an alternate vault instead of your main collection", and adds that it "changes the collection shown" S2. Keepsafe's Decoy Vault (Premium) is "a second Keepsafe gallery with a separate PIN" S3. Vaultaire opens a different vault for a different pattern S4.
What a decoy fools, and what it doesn't
| Situation | Does a decoy help? |
|---|---|
| A friend grabs your phone and opens the app | Yes. They see the decoy unless they see you type the real passcode. |
| Someone insists you open the app in front of them | Often. That's the case decoys are built for. |
| Someone who knows the app has decoys | Less. The feature is listed on App Store pages S5 S6 S4, so they may ask for "the other passcode". |
| Someone checks Settings › General › iPhone Storage | No. It lists each app's storage use S1; ten decoy photos in an app using several gigabytes stand out. |
| Copies outside the vault | No. Photos left in Photos, Recently Deleted (30 days) or iCloud Photos are outside any vault S7. |
| Forensic analysis of the iPhone | Not designed for it. Treat a decoy as protection against people, not labs. |
Making a decoy believable
- Fill it with real, dull content: receipts, screenshots of recipes, a few ordinary photos. An empty vault looks like a decoy.
- Add to it now and then, so the newest item isn't from the day you set it up.
- Pick a passcode that's easy to type under pressure, and different enough from the real one that you won't mix them up.
- Clean up the originals. After you move photos into the real vault, empty Recently Deleted in Photos S7.
Duress modes: decoys that also erase
Some apps let the decoy passcode do more than show a different vault. Vaultaire's Pro duress vault "removes access to your other vaults on this device" S4. Hushtrove has an optional duress mode too (below). Think before turning one on: erasing is permanent on that iPhone, and if you have no backup, what's erased is gone for good. Erasing data can also have legal consequences in some situations; a decoy is a privacy tool, not legal advice.
Hushtrove's decoy vault
In Hushtrove, our app, the decoy vault is part of Pro. Set it up in Settings › Decoy Vault › Set Up Decoy Passcode. Lock the app and enter the decoy passcode, and a separate vault opens. Whether a decoy exists is recorded only inside the real vault's encrypted index, not in plain app settings.
Turn on the optional duress mode and the decoy passcode also quietly erases the real vault on that iPhone. Your iCloud backup, if you have one, is untouched, so you can restore later with your passcode or Recovery Key. Other Pro defences pair well with a decoy: Intruder Selfie photographs anyone who enters a wrong passcode, Panic Lock locks the vault when you flip the iPhone face down, and Auto-Wipe erases the vault after 10 or 20 wrong passcodes, set by you.
The same limits apply as for any decoy: it fools people looking through your phone, not forensic analysis, and it can't hide the app's storage size.