What a decoy vault does, and how it fails

A second PIN vs AlterVault's shake

Each one fits a different moment, and neither is better in both.

AlterVault

Second PIN

The moment

Real photos already on screen

One shake

Leave the app, reopen it, type the PIN

App locked when you are asked

Real code first, or a second space's code with Pro

Type the second PIN

Someone watching your hands

They see the phone move

They see a code typed

Asked to open it a second time

Real code, unless you set up a second space

Type the second PIN again

What you get

Included for free

✓

Varies, Premium on Keepsafe

Photos it holds

6 free, 60 with Pro

Depends on the app

The moment encryption does not cover

If a thief has your phone, encryption ends the story. A key that was never typed cannot be used.

It does nothing when someone is in front of you and says open it. You can comply, or you can refuse, and refusing tells them there is something to see.

A decoy adds a third answer: you open the app, and what they see is harmless. Researchers who build stronger versions of this describe the goal narrowly. One paper calls it "only a technical measure to prevent a user from being punished if caught with contentious material", and notes that an adversary can always take the device anyway.

Sources: Skillen and Mannan: Mobiflage, deniable storage encryption for mobile devices

Decoy, fake PIN, panic PIN, duress code

These words get used as if they mean the same thing. They do not, and the difference matters if you are relying on one.

Decoy vault

A second gallery of harmless photos inside a vault app. The term describes what you show, not how it opens.

Fake PIN or decoy password

The usual way in. You set a second code, and typing it opens the decoy instead of your real vault.

Panic PIN

A loose term. Some apps mean a code that opens a decoy, others mean one that deletes something. Find out which yours is before you need it.

Duress code

Usually a code that destroys data. GrapheneOS, a privacy-focused Android system, has a duress PIN that "will irreversibly wipe the device". Vaultaire's guide says its duress mode deletes the other vaults on the phone and cuts it off from sync, without erasing cloud backups.

Disguised icon

A vault that looks like a calculator or a clock. It hides the app, not the photos, and researchers confusingly call this a decoy app too. In a 2022 study of 20 Android vault apps, 10 offered a disguise, 7 of those actually worked, 5 turned it on at install and only 3 kept it up in the phone's app list.

Deniable storage

The research goal: nobody can prove a second vault exists, even with the raw files. It is far harder than a decoy. Vaultaire says its own design "hides vaults from normal navigation, not from every forensic storage inspection".

Sources: GrapheneOS: Duress PIN/Password, Vaultaire, a competing app: Plausible deniability in apps, Ruffin et al.: Casing the Vault, ACM WPES (2022)

Which apps and phones have one in 2026

Keepsafe

Decoy Vault is a Premium feature on iPhone and Android. A second PIN opens a second gallery.

Private Photo Vault

A Decoy Password opens a separate gallery. The company says plainly that it is "not a guarantee that another vault's existence cannot be discovered".

LockMyPix

A Fake Vault behind its own code. The App Store listing describes a secondary PIN that opens a decoy gallery of harmless photos.

Vaultaire

iPhone only. Each pattern on a 5 by 5 grid opens its own vault, and a second pattern can serve as the decoy.

Inner Gallery

iPhone only. A Panic PIN opens a second space. Its blog says this works "against casual observation, not necessarily against a full forensic examination".

AlterVault

Android and iPhone. A shake rather than a PIN, on the free tier. The next sections cover how it works and where it falls short.

iPhone itself

No decoy and no duress code. The Hidden album has neither.

Android itself

We found no duress code in standard Android. Google's Locked Folder and Samsung's Secure Folder have no decoy. GrapheneOS adds a duress PIN, and it wipes the phone.

Read from vendor pages, help centres and store listings in November 2026. We have not installed or tested these apps, and features move, so check the current listing before paying.

Sources: Keepsafe Help: What is the Decoy Vault feature?, Private Photo Vault: How your private photos are protected, LockMyPix on the App Store, Vaultaire, a competing app: Plausible deniability, Inner Gallery, a competing app: What is a panic PIN? (March 2026), GrapheneOS: Duress PIN/Password

Seven ways a decoy gives itself away

Decoys fail in ordinary ways. Most of them come down to how it was filled, not how it was built.

1. It is too thin

   A handful of pictures looks like a factory reset, not a phone someone uses. A near-empty gallery tells the person holding it that this is not the real one.

2. It is all one kind of photo

   A real camera roll is messy: screenshots, receipts, food, blurred shots. A neat grid of landscapes looks like a folder of wallpapers.

3. It has no reason to be locked

   This is the one people miss. Nobody locks up their sunsets, so a vault full of them invites the next question. A decoy needs a small, believable secret: gift ideas, a few bad selfies, a surprise booking.

4. It all arrived at once

   Many vaults date an item on the day it was imported, and AlterVault does too. One afternoon's import does not look like a year of use.

5. It has gone stale

   A gallery with nothing added since the day you set it up tells its own story.

6. The storage number disagrees

   Your phone reports how much space an app uses, whichever gallery is open. On iPhone that is Settings, General, iPhone Storage. Thirty photos in a 14 GB app do not add up, and this applies to any vault that keeps files on the phone.

7. The person knows decoys exist

   Store listings advertise the feature, so anyone can look up the app in a minute. If they ask whether there is a second gallery, you are back to refusing or lying.

How to set one up so it holds

These steps work in any app with a decoy.

1. Be clear who it is for

   A partner, a parent, a friend, a stranger with your phone for a minute. That is the range a decoy covers. The last section covers who it does not.

2. Use your own photos

   Replace any starter pictures. Bundled photos are the same on every install, so they can be recognised.

3. Make it a mess

   Aim for forty or more, with screenshots, receipts, food and a few bad shots mixed in.

4. Give it a small secret

   Something you would mildly rather not show. It answers the question of why this gallery has a lock.

5. Add photos in batches

   A few at a time over a couple of weeks, so the dates do not all land on one day.

6. Go back to it

   Add something every month or so, so it does not stop on the day you built it.

7. Keep anything real out

   A decoy is built to be shown. Never put anything in it that you would mind someone seeing.

8. Practise the trigger

   Repeat it until you can do it without looking at the screen. A decoy you fumble in the moment is worse than not having one.

How AlterVault's decoy works

AlterVault uses a shake instead of a second PIN, because the most awkward moment is when your real photos are already on screen.

One sharp shake swaps the gallery

In your real gallery, one hard shake replaces it with the decoy at once. There is no code, no confirmation and no animation, and one firm buzz tells you it fired without looking.

It reads as a plain gallery

The header and grid are the same, with no badge. Settings inside the decoy has no security, spaces or shake rows, and no erase option.

Shake again to come back

Hold still for a moment, then shake. A keypad appears, you enter your code, and your real gallery returns. With no input for five seconds, the keypad clears itself.

Separate key, separate storage

The decoy has its own key and its own storage slot, so nothing in it can reach your real photos.

You can tune it

Sensitivity starts on Low, which takes a hard shake, and moves to Medium or High. Shakes to Switch sets how many shakes bring the keypad back, from one to five. Both sit in your real gallery's Settings.

It is free

The shake and the decoy are on the free tier, with 6 starter photos. Pro is $24.99 once or $4.99 a month and raises the decoy to 60 photos of your own.

Where AlterVault's decoy falls short

A page about decoys that skips its own limits is not worth reading, so here are ours.

There is no decoy code

The decoy opens with a shake, from inside your real gallery. If the app is locked and someone says open it, the only code that works shows your real photos, and the shake stays off for two seconds after unlocking. In that moment a second-PIN app is better.

The workaround needs Pro

Use Add a Space in Settings, give the space its own code, and fill it with harmless photos. That code then works like a fake PIN at the lock screen. Its Settings is the full screen, though, including the Shake and Spaces sections.

Leaving the app locks it

With Auto-Lock at its default, switching apps brings up the keypad, and someone holding the phone cannot get back to the decoy. Setting Auto-Lock to 1 or 5 minutes gives more room, but that choice resets when the app fully closes.

The starter photos are thin

The free decoy holds 6 low-resolution landscapes, the same on every install, so anyone who knows the app can recognise them. They fill the free limit, so the + button reports the decoy as full.

A shake in the decoy shows a keypad

If someone shakes the phone, a keypad appears and clears after five seconds. They cannot fill it, but it tells them something sits behind the gallery. Raising Shakes to Switch makes this less likely.

The app is still there

With Pro you can change the icon to Calculator, Notes, Weather or Clock. On Android the name changes too. On iPhone the name under the icon stays AlterVault, and your store purchase history shows the app on either platform.

Storage gives away the size

From first launch, files sit in a fixed set of encrypted slots filled with random data, so a file listing does not say how many spaces you use. It does not hide how much they hold, and your phone's storage screen shows the true total.

The decoy is not a vault

It opens without a code by design, so the swap can be instant. Its photos are encrypted, but its key is kept where the app can read it with no code. It has no recovery phrase and no backup file. Treat its contents as public.

What the app reports

The anonymous usage events sent to PostHog include that the shake was used, and how many seconds after unlocking. They carry no photos, file names or codes, and they do not say which gallery is open.

AlterVault has no outside audit to show, and the decoy has not been tested by a forensic examiner. Think of it as protection against a person looking at the screen, not against a lab.

When not to use a decoy

A decoy is for nosy people. It is the wrong tool for the cases below, and using it there can leave you worse off.

US border and federal officers

Do not use one. EFF's border guide says "do not lie to a border agent", and it recommends against methods "calculated to deceive or mislead border agents about what data is present on a device". Under federal law a knowingly false statement can carry up to five years in prison. EFF's advice is to decline politely, and to expect that agents may seize the phone or hold you longer.

UK police

A police request for your PIN is not automatically a legal duty, according to Reeds Solicitors. A formal section 49 notice is. Failing to comply carries up to two years in prison, or five in national security and indecent images cases.

Someone who might hurt you

If a partner's phone checks come with fear or threats, a decoy is not a safety plan, and being found out could put you at more risk. An advocate can help you think it through. In the US, the National Domestic Violence Hotline is on 1-800-799-7233, and the Safety Net project at NNEDV publishes phone safety guides for survivors.

A wipe code after a legal demand

Deleting data you know is wanted is its own risk. Inner Gallery warns that using a wipe-style duress code after a court order "could result in obstruction charges or contempt of court".

What to do before a checkpoint

The stronger steps are dull. Leave what you do not need off the phone, and turn off face and fingerprint unlock. On iPhone, hold the side button and a volume button for two seconds, and Face ID then needs your passcode. On Android, the Lockdown option in the power menu turns off biometrics until your next unlock.

This is general information, not legal advice. Laws differ by country and they change, so speak to a lawyer about your own situation.

Sources: EFF: Digital Privacy at the U.S. Border (2017), 18 U.S.C. § 1001, Cornell Legal Information Institute, Reeds Solicitors: Do I have to give the police my phone PIN?, National Domestic Violence Hotline, Safety Net at NNEDV: Resources for survivors, Inner Gallery, a competing app: What is a panic PIN? (March 2026), Apple: About Face ID advanced technology, Android Central: How to quickly lock down your Android phone

Questions