Avoid the first guesses
- straight rows, columns, and diagonals;
- simple letters, boxes, crosses, and spirals;
- the same pattern used for the phone screen lock;
- shapes derived from a birthday, address, initials, or public logo;
- patterns regularly drawn where another person or camera can observe them.
A better creation method
- Invent a private verbal route with several turns, not a visible letter.
- Translate it into a pattern and check that it is not a familiar shape.
- Practice it privately until it is reliable.
- Create recovery material and store that outside the device.
- Lock immediately after access and avoid drawing in crowded spaces.
Example: Instead of drawing the initial “M,” Rina remembers a private route: “harbor, bridge, hill, return.” The phrase cues a longer non-letter shape. She does not write the point sequence in Notes or store the recovery phrase beside the phone.
Separate vaults need separate thinking
With NullVault, different patterns open different vaults. Reusing one pattern with a tiny variation can make the other space easier to infer. Choose patterns that are visually and conceptually independent, and decide which vault you can safely access in ordinary public situations.
Observation is different from offline guessing
Memory-hard derivation raises the cost of testing candidates against copied data. It does not help when someone watches the pattern, records the screen interaction, or coerces you to reveal it. Screen privacy, physical surroundings, automatic lock, and threat-specific planning remain necessary.
Do not test destructive controls casually
Duress and panic features may irreversibly invalidate local access. Understand the exact action, backup exclusions, and recovery consequences before associating them with a pattern you might enter accidentally. Read decoy vault vs destructive duress vault.
Guide reviewed: 28 August 2026.