Plausible deniability in apps, explained: what it can really do

Where the idea comes from

The phrase comes from encryption tools for computers. The strong version works like this: a disk or file holds two encrypted areas. One password opens the outer area, with files you don’t mind showing. A second password opens an inner area. Without that second password, the inner area looks exactly like random filler, so no one can prove it exists, not even with the whole disk in hand.

That last part is the point. Deniability is not about what is on screen. It is about what can be proved from everything else.

What phone apps usually offer instead

Most vault apps that use the word mean something simpler: a second passcode that opens a second, ordinary vault. What is a decoy vault covers when that helps in daily life. Here is how it measures against the strong version.

The store page row matters more than it looks. If the app’s listing names a decoy feature, anyone who reads it knows to ask whether you have one. Deniability then rests on the other person not knowing, which is a guess, not a guarantee.

Three things deniability can’t fix

Someone who knows the app. A person who has used the same vault knows what its real screens look like. Missing rows in the settings, an empty-looking vault or a backup status that never appears can all tell them something.

Someone who reads storage, not screens. If the second vault is only a filter over the same records, a careful look at the phone’s data may show more items than the screen did. Whether that is possible depends on how the app is built.

Someone who uses your face. If face unlock always opens the real vault, a second passcode only helps when you are the one typing.

Decoy and duress: two different tools

A decoy shows a different space and leaves the real one where it is. A duress code shows the decoy and, at the same moment, removes the real vault from the phone. They answer different worries. The decoy is for a calm “here, have a look”. The duress code is for a moment when you want the real vault gone from the device, and it only makes sense if a backup can bring it back later. The duress code page explains how Sealed handles that, and it is clear that it is not a forensic wipe. Sealed says plainly that the duress code is not a forensic wipe, that anything not yet in iCloud is lost, and that anyone who can make you unlock with Face ID or Touch ID, or who knows your real passcode, still sees your real vault.

If someone is threatening you, your safety comes before any setting. No app feature is a plan for that, and a code that wipes data can make a tense moment worse.

Questions to ask any app that claims deniability

1. Is the second space stored separately, or only filtered?
2. Do its settings look the same as the real ones?
3. What does face or fingerprint unlock open?
4. Is the second space backed up, and where?
5. Does the app say plainly what it does not protect against?

An app that answers all five in writing is being straight with you. One that only says “plausible deniability” is selling a phrase.

Where Sealed helps, and where it doesn’t

It helps with a believable second vault. A decoy vault opens with a second passcode, and it is part of Sealed Pro. The decoy passcode opens a separate vault with its own content, and you fill it yourself: unlock with the decoy passcode and add items. Setup is on the decoy vault page.

It helps keep the decoy’s settings looking ordinary. In the decoy vault, Settings leaves out your plan and iCloud backup, Location Lock, Break-In Report, Decoy Vault, Transfer and Data & Storage, and the vault home leaves out the backup status line.

It doesn’t store the decoy as a second encrypted area, so it is not the strong version. Decoy items are kept in the same database as your real items, marked by a flag, and the decoy vault opens with the same vault key, so it is a filtered view and not a second encrypted store.

It doesn’t keep the duress option out of sight from someone inside your real vault. Anyone who gets into your real vault can see that a duress option exists.

It doesn’t apply when your face does the unlocking. Face ID and Touch ID always open your real vault: the decoy vault opens only with its own decoy passcode or decoy pattern.