Plausible deniability

What it is

Plausible deniability means you can show someone part of what you have without it being obvious there is more. VaultWell is built so the screen gives nothing away. When locked, it shows a dark honeycomb and nothing else: no title, no shield, no count of vaults, no hint links.

Any path either opens a vault or looks wrong. A path that never existed and a mistyped path look the same.

How to use it

1. Create your main vault with a path only you know.
2. Create a second vault with different, everyday content and its own path.
3. If you're asked to open the app, you can open the everyday vault. Nothing inside it mentions any other vault.
4. Optionally set a disguise icon so the app looks like something else on your home screen.

How it works under the hood

Each vault's location on disk is worked out from its own key, so the app can't list vaults without their paths. Every vault has a settings file padded to exactly the same size, so options such as "this is the duress vault" can't be told apart from the outside. The lock screen's menu (recovery, restore, join a share) sits behind a long-press on the centre cell rather than on visible buttons. In the app switcher, VaultWell always shows the dark comb.

Honest limits

Deniability on screen is not the same as being invisible to a forensic examination.

• Someone who can read the app's raw files on an unlocked phone could see how many encrypted vault folders there are, and how many have a recovery phrase. They can't read them, but they could infer that more than one exists. We plan to reduce this and will publish details on the security page.
• Someone who knows VaultWell supports several vaults may simply not believe there is only one.
• The app itself is visible on your phone, even with a disguise icon.

Questions