The short answer
A decoy vault is a second, complete vault behind a second passcode. Under pressure, you open it. A self-destruct passcode erases the real vault when entered at the lock screen. Together they answer the question a lock cannot: what happens when you are made to unlock.
Decoy vault
You set a second passcode. Entering it opens a vault with its own albums and items, unrelated to the main one. There is no list of vaults and no indicator that another exists. Whoever is watching sees an ordinary unlock and ordinary contents.
Some apps offer a fake PIN that shows an empty or different album. A true decoy is a whole vault, with settings and albums, that behaves like the real thing because it is one.
Self-destruct passcode
You set a third passcode. Entering it at the lock screen erases the vault. In Kryptis the master key is deleted first, so anything left on flash storage is unreadable, then the main and decoy vaults, then the Burner Email token, and the app opens a clean empty vault as if nothing happened. No countdown and no confirmation, because a confirmation is exactly what someone standing over you would wait through.
Which apps have them
Privault is the only app in the ten most-rated vaults besides Kryptis with both a decoy passcode and an erase-all passcode. Private Photo Vault, Secret Photo Album, Safe Lock and PV have a decoy or fake password. Keepsafe has a fake PIN on Premium. Calculator# has a Panic Switch that hides rather than erases. The rest have neither. The full table.
Using them well
- Keep the decoy populated. An empty decoy is a tell.
- Keep an encrypted backup somewhere other than the phone, so self-destruct is a choice, not a loss.
- Turn Face ID off for the vault. A passcode can be withheld in ways a face cannot.
- Practise the passcodes. Under pressure you will not have time to think.
