Decoy Vaults

Each unlock pattern you draw opens its own encrypted vault. There's no list of vaults, no dropdown menu, and no way for someone looking at the app to know how many vaults exist or which one is which. Draw a second pattern, put a few harmless documents in it, and you have a decoy vault for situations where someone insists you unlock the app.

How it works

When you draw an unlock pattern:

1. UnderKey hashes the pattern using PBKDF2 with a unique salt to produce a 256-bit encryption key.
2. That key unlocks one specific vault. If no vault exists for that pattern yet, UnderKey creates a new empty vault.
3. Each vault is completely independent. Documents in one vault are invisible to other vaults. The vaults don't know about each other.
4. There's no vault list or indicator. The unlock screen looks the same whether you have one vault or ten. Nobody can tell how many vaults exist just by looking at the app.

This means you can set up a second vault with a different pattern, add a few innocuous documents (grocery receipts, restaurant menus, old tickets), and use that vault when you need to show someone that the app unlocks but you don't want them to see your real documents.

Why decoy vaults matter

In some situations, refusing to unlock your phone or saying "I don't have anything on here" makes things worse. Decoy vaults give you plausible deniability:

• Border crossings: Some countries demand that travellers unlock their devices for inspection. If you're carrying sensitive documents (passport scans, business contracts, crypto wallet backups), a decoy vault lets you comply without revealing everything.
• Coercion or theft: If someone forces you to unlock the app — whether it's a mugger, an abusive partner, or a hostile authority — you draw the decoy pattern and they see the decoy vault.
• Shoulder-surfing: If someone is watching you unlock the app in public, they see you enter a pattern but they don't know it's the decoy one.

How to set up a decoy vault

1. Open UnderKey and create your main vault with your chosen unlock pattern. Add your real documents.
2. Lock the app and draw a different pattern. UnderKey creates a new, empty vault for that pattern.
3. Add a few harmless documents to the decoy vault: old receipts, shopping lists, saved articles, restaurant menus, or photos of books and magazines. Make it believable but boring.
4. Lock the app again. Now you have two vaults: your real one and the decoy.

When someone asks you to unlock the app, draw the decoy pattern. They see the decoy vault, which looks real enough to satisfy them, but doesn't contain your sensitive documents.

What makes a good decoy

A decoy vault needs to look plausible. If it's completely empty or contains obviously fake documents, it defeats the purpose. Here's what to put in it:

• A few low-stakes documents: grocery receipts, takeaway menus, event tickets, instruction manuals.
• Generic notes: a shopping list, book recommendations, a saved article from a news site.
• Old or expired items: an insurance card from last year, a boarding pass from a past trip, a warranty that's run out.

The decoy should look like something you'd keep in a document app but wouldn't care if someone saw. Don't put anything in it that raises questions or looks like a test.

Limits and risks

• Decoy vaults aren't foolproof. If someone watches you unlock the real vault first, they know your real pattern. The decoy only works if they don't already know which vault is real.
• You have to remember both patterns. If you forget your real pattern, you can't recover it — even if you remember the decoy one.
• Forensic tools can potentially detect multiple vaults. While there's no obvious indicator in the app, someone with physical access to your device and forensic software might be able to detect that multiple encrypted vaults exist. Decoy vaults provide plausible deniability, not absolute undetectability.
• Lying to authorities may have legal consequences. In some jurisdictions, providing a decoy vault to law enforcement instead of the real one could be considered obstruction. Check your local laws before relying on this feature in a legal context.

Can you have more than two vaults?

Yes. You can create as many vaults as you have patterns. Each pattern opens a different vault. But remember: you have to remember every pattern. If you forget one, there's no way to recover it.

Related features

• Offline AES-256 encryption — how each vault is encrypted independently

Related guides

• How to keep scans of your ID and passport safe on your phone
• UnderKey for travelers — protecting documents when crossing borders