Plausible deniability in apps: what it is and where it stops
In an app, plausible deniability means the screen does not prove a second Vault exists. StrongRoom shows no list of Vaults, shows an Empty Vault for a credential that opens nothing, and stores Vaults in 16 identical slots. It does not hold up against a determined forensic examination, and a Decoy Vault only helps if you actually open it.
What deniability means here
The phrase comes from encryption research. An encrypted store has plausible deniability when someone who sees it cannot show that more is hidden inside than you have revealed. In a phone app the idea is much narrower and more modest: when someone looks over your shoulder, or hands you the phone and says "open it", what they see should not tell them whether there is more.
Most vault apps fail this at the first step. They show a list of vaults, a count of items on the home screen, or an error such as "wrong pattern", and each of those is a statement about what exists. The tools below remove those statements. They do not remove the data's existence from the phone, and the guide is clear about that below.
Four parts of the design
- No list of Vaults. There is no screen anywhere in StrongRoom that lists your Vaults. Each Vault is reached only by its own pattern or passphrase.
- The Empty Vault. A credential that opens nothing does not produce an error. It shows an empty Vault that looks the same as a real Vault with no items in it. Nothing is kept in it, and opening it creates nothing. This works in the free app, which has one Vault.
- Sixteen identical slots. Vaults are stored in 16 fixed, identical-size encrypted records called Slots. A Slot is always present whether or not it holds a Vault, and an empty one looks like an occupied one. More than one Vault is a Pro feature.
- The Decoy Vault. With Pro, an ordinary extra Vault that you fill with harmless items and are willing to reveal. It has no destructive behaviour; it is simply the Vault you open when pressed.
No Face ID or other biometric opens a Vault, because a biometric would pick one Vault and show that it exists.
What a decoy needs to work
A Decoy Vault only works if it is believable and if you actually open it. It must hold things that someone would expect to find on your phone, and it must have a credential you can enter without hesitation. A Decoy Vault with three photos in it, opened with a pattern you never use for anything else, is a cue, not a cover. It also protects nothing by itself: the real Vault is protected by being encrypted, not by the decoy.
The Empty Vault is the simplest cover and the easiest to keep consistent. The honest weakness is that some people will not believe an empty vault belongs to someone who installed a vault app.
Where it fails
State these plainly, because the failures matter more than the features.
- The app is visible. StrongRoom does not hide its icon or pretend to be another app. Anyone who sees it knows what it is.
- Forensics. Someone with the right equipment who examines the phone's storage may be able to infer that the app holds data and how much. Every Slot is a fixed size, so the app's files do not show how many Vaults exist, but the phone's Keychain records which Slots were used, and total storage use can still be seen. We make no claim that an examiner could not tell.
- Being told to hand over everything. Deniability does not help against someone who demands every credential you have, or who does not accept that there is only one Vault.
- Habits and records. Messages, photos left in your library, an Export Package saved in Files, or a purchase of Pro in your Apple Account history can each point to what the screen does not.
- Mistakes under pressure. The plan only works if you can carry it out calmly. Practise on a throwaway Vault before you rely on it.
For the full list, see the limits page.
Duress Vault is a different thing
A Decoy Vault changes what is shown. A Duress Vault changes what exists: opening it erases every other Vault on the phone, for good. That is a separate choice with serious consequences, covered in the guide on duress passwords.
Legal note
Whether deception of this kind, or destroying data on request, is acceptable depends on where you are and who is asking. This is not legal advice.
Keep reading
- What is a duress password?
- Does a photo vault really encrypt your files?
- Multiple Vaults, the Empty Vault and the Decoy Vault
- What is an Empty Vault?
- What StrongRoom does not protect against
Frequently asked questions
Can an app really hide that a second Vault exists?
It can avoid saying so on screen. It cannot promise that a forensic examination of the phone would not find clues.
What is an Empty Vault?
What StrongRoom shows for a credential that opens nothing: a Vault with no items, the same as a real one that has none. It works in the free app.
Do I need Pro for a Decoy Vault?
Yes. A Decoy Vault is an extra Vault, and more than one Vault is part of Pro.
Does StrongRoom disguise itself?
No. It has no alternate icon and does not pretend to be another app.
Is a Decoy Vault the same as a Duress Vault?
No. A Decoy Vault only shows harmless items. A Duress Vault also erases the other Vaults when opened.