Two claims of very different strength
A decoy vault presents ordinary content under one credential. It can change what that credential reveals, but it cannot guarantee an observer will accept the decoy or ensure physical safety under coercion.
Plausible deniability is a much stronger claim: that an observer cannot establish whether other protected data exists at all. Most app designs cannot deliver it, and the gap between the two is where people get into trouble.
The evidence that undermines deniability
Deniability fails on evidence outside the app's control, and there is more of it than the feature description suggests.
- Installed-application records and store purchase history.
- Total storage consumed by the app relative to what a decoy would explain.
- Device backups containing the application container.
- Notification history, usage statistics, and battery attribution.
- Exports and copies that previously left the vault.
Destructive duress is a different mechanism
A destructive duress credential opens one space while invalidating access to others. It changes what remains available; it does not prove that nothing else ever existed.
It can remove local access, while an independent valid backup may still remain recoverable. That trade should be made deliberately; use disposable test data to examine accidental-trigger consequences rather than testing destructive behavior on real data.
Model the observer specifically
- Define who the observer is and what evidence they can actually inspect.
- Separate non-destructive decoy behaviour from destructive duress behaviour.
- Use disposable test data to examine accidental-trigger consequences before enabling anything irreversible.
- Confirm what a backup preserves, since a backup can contradict a deniability claim.
Claims not to make, or believe
- Promising deniability on the strength of a second PIN alone.
- Enabling irreversible actions without a tested recovery path.
- Assuming a decoy defeats an observer who can inspect storage or backups.
What is realistically achievable
A decoy that shows plausible content, and a design that does not display a list of vaults or a vault count, meaningfully change what one disclosed credential reveals.
That is a real and defensible property. It is not the same as proving absence, and a vendor that markets the second while implementing the first is describing a guarantee nobody can honour.
A fictional example
Priya starts with a non-sensitive test: “Define the observer and evidence they can inspect.” Next, Priya follows the second check: “Separate non-destructive decoy behavior from destructive duress.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Promising deniability from a second PIN alone
- Enabling irreversible actions without recovery
What this workflow does not change
- Promising deniability from a second PIN alone
- Enabling irreversible actions without recovery
Questions people ask
Does NullVault claim perfect plausible deniability?
No. Its Android design avoids a visible master list and supports separate vault patterns, but device-level evidence can remain.