What does a fake password open?
People looking for a photo vault with a fake password usually want an ordinary-looking collection instead of their private one. In NullVault, this is a real separate vault reached with its own valid pattern. Opening it is non-destructive unless it has explicitly been designated as a duress vault.
Use ordinary decoy vaults for separate benign content. Duress and Android panic wipe are different destructive actions. A decoy cannot guarantee safety under pressure or make other device traces disappear.
When a decoy helps, and when it doesn't
A decoy helps when someone wants a quick look: a partner scrolling your phone, a relative asking to see your photos, a stranger who insists. You open an ordinary vault, they see ordinary photos, and your private vault stays out of sight.
It helps much less when someone already knows a lot about you, knows which app you use, or keeps pushing after you've shown them something. A decoy is a way to avoid showing everything. It isn't a guarantee that the pressure stops.
Set up a decoy in four steps
- Create a new vault with a pattern you'd be comfortable drawing in front of someone.
- Fill it with ordinary photos and notes, so it looks like a vault you actually use.
- Lock NullVault and practise opening the decoy, then your private vault, so both feel natural.
- Keep your private pattern different and never draw it where it can be watched.
Only add a duress vault after you've answered the questions below. A decoy alone is enough for most people.
Compare the outcomes
| Question | Ordinary decoy vault | Destructive duress vault |
|---|---|---|
| Opens plausible content | Yes | Yes |
| Reveals a master vault list | NullVault does not show one | NullVault does not show one |
| Destroys access to other local vaults | No | Yes, by design |
| Protects exported backup files | They remain separate | Exported backups are not deleted |
| Can guarantee safety during coercion | No | No |
Example: Alex creates a work-receipts vault that can be opened in public without exposing a personal vault. That is compartmentalization, not destruction. If Alex designates it as the duress vault, entering its pattern during a coercion event also invalidates local access to the other vaults. A mistaken entry can therefore cause permanent local loss.
Questions to answer before enabling duress
- Is permanent local loss preferable to disclosure in your specific threat model?
- Is there a current encrypted backup, and is it stored outside the device?
- Is the backup recovery phrase separate and accessible after the incident?
- Could a child, partner, or your future self enter the duress pattern accidentally?
- Could visible data loss increase danger rather than reduce it?
What destructive duress does not delete
It does not erase exported backup files, recipient copies, Android system snapshots, cloud-provider metadata, or previously written physical storage cells. It cannot retract content already displayed or exported. It is an access-invalidation response, not a universal erasure guarantee.
Destructive duress is available on iOS and Android, but the exact key invalidation and backup boundaries differ by platform. Review the duress vault feature and security limitations before relying on it.
If you're in danger
If someone is threatening or controlling you, your safety matters more than any setting. Changing apps or deleting things can sometimes make a situation worse. The Safety Net technology-safety plan explains how to plan device changes safely, and local domestic-abuse services can help.
Guide reviewed: 2 October 2026.