What is a decoy vault, and does it actually protect you?

Picture someone who knows you use a vault app (a partner, a parent, someone at a border) saying "open it". Refusing makes things worse. A decoy vault gives you a third option: open it, and show them something harmless. Here's how decoy vaults work, the two very different ways apps build them, and their honest limits.

How does a decoy vault work?

The app accepts more than one code. Your real code opens your real vault. A second code opens a separate vault you've filled with ordinary photos. To anyone watching, both look like you simply opened the app.

You'll also see it called a fake PIN, decoy password, fake vault or secondary passcode. The idea is the same; how well it's built varies a lot.

What are the two kinds of decoy vault?

Some apps show a fake screen; others open a genuinely separate, encrypted vault.

• A fake screen or fake gallery. The decoy code opens a different view in the same app, often with a settings menu that still shows the decoy option. Anyone who looks through the app's settings, or knows the app, may see that a decoy exists.
• A separate encrypted vault. Each code unlocks its own vault with its own encryption key. The app can't show a list of vaults, because it can't read the other vaults without their codes. A wrong code simply opens nothing.

The second kind is much harder to see through, because nothing inside the decoy points to anything else.

What can't a decoy vault do?

A decoy buys you a calm moment; it doesn't make your real photos disappear.

• It has to be believable. An empty decoy, or one with three photos, invites more questions. Put real, boring photos in it and add a few now and then.
• It doesn't beat a determined expert. Storage usage, backups, or forensic tools may show there's more data than the decoy explains.
• Face ID can give it away in apps where Face ID opens your real vault while someone watches. Use the decoy code when you're under pressure, not Face ID.
• It's not legal protection. Laws on unlocking devices differ by country. A decoy is a privacy tool, not advice on what you must or mustn't do.

How is a decoy vault different from an emergency erase or duress code?

A decoy hides your vault; an emergency erase code destroys it. Some apps offer a third code that opens a harmless vault and, at the same time, quietly deletes the others. That protects the photos from being seen, but they're gone. If the app can also delete the cloud backup, there's no way back.

Only set up an erase code if losing those photos is better than them being seen, and keep a copy elsewhere if you can't afford to lose them.

Which photo vault apps have a decoy vault?

From their App Store listings on 22 October 2026:

Listings don't say which kind of decoy they are, so test it: open the decoy and look through every screen, including settings. If anything mentions another vault, so will the person looking. See all 17 apps in our comparison.

How do you set up a decoy vault well?

1. Pick a code you won't mix up with your real one, but can recall under stress.
2. Fill it with real, dull photos: food, a trip, screenshots, a pet. Dozens, not three.
3. Use it now and then so the dates aren't all from one day.
4. Practise opening it once or twice so you don't hesitate when it matters.
5. Check nothing gives it away: open the decoy and look through settings, albums and counts.

In Noxium, which we make, each pattern derives its own key, so a decoy is a separate encrypted vault. Noxium never shows a list of vaults, nothing in the decoy marks it as a decoy, and Face ID only ever opens your main vault. You add one in Settings with "Add a decoy vault" and draw its pattern. The free plan includes one.

Questions people ask

Something wrong or out of date? Email business@inertiaprojects.info and we'll fix it.