Decoy Vault: A Second Pattern That Opens Harmless Photos

The decoy vault is a vault with harmless photos you chose, opened by a second pattern you set up in advance: the decoy pattern. If someone forces you to open sigil., you draw the decoy pattern instead of yours. The decoy opens, nothing is erased, and your real vault stays hidden. To someone watching over your shoulder, it looks like you simply unlocked the app.

How it works

1. You turn on the decoy vault (it is free and off by default) and choose a decoy pattern, different from your real one.
2. You put some ordinary content in it, so it looks lived-in. You can fill it quickly with recent gallery photos and review them before they are encrypted.
3. If you are ever forced to open the app, you draw the decoy pattern instead of your real one.
4. sigil. opens the decoy vault. Your other vaults are not touched.

Because sigil. shows no list of vaults (see hidden vaults), nothing on screen reveals that another vault exists. Inside the decoy, counters, limits and messages refer only to the decoy itself.

The general idea is older than this app — banks and alarm systems have used "duress codes" for decades. Our explainer on what a duress password is covers the history and the variations.

When it can help

• Robbery or theft with coercion. Someone takes your phone and demands you unlock everything. Your safety comes first: hand over what they ask for. If opening the app is part of that, the decoy pattern lets you comply without exposing your real vault.
• An abusive or controlling person demanding to see your phone. If that describes your situation, please also reach out to local support services; an app is not a safety plan on its own.
• Informal pressure — someone who has no authority but insists on seeing "what's in that app."

When not to use it

Our pages on border crossings and journalists and sources go into this in more detail.

Caveats you should know before turning it on

• It hides, it does not destroy. Your real vault is still on the phone, encrypted. That also means nothing is lost if you draw the decoy pattern by mistake.
• It cannot reach copies. If you exported or shared photos, those copies are outside sigil.
• It does not hide that you use a vault app. Someone who knows how sigil. works may suspect that more than one vault exists.
• The decoy must be believable. An empty vault invites the question "where is the rest?" Put real, low-stakes content in it.
• Remember which pattern is which. Pick a decoy pattern clearly different from your real one, and write nothing next to the phone.

How it fits with encryption

The decoy vault does not weaken the encryption of your real vault. Each vault is still encrypted with a 256-bit key that only its own pattern can unlock (see pattern encryption). The decoy pattern is simply the pattern of another vault.

Decoy vault versus self-destruct

The decoy pattern is something you draw, on purpose, when you are being forced, and it erases nothing. Self-destruct (free as well, off by default) covers the opposite case: someone who has your phone and is guessing. If it is on, too many wrong patterns within a time window (by default 50 in 24 hours, configurable) erase the vaults, with growing waits between attempts and no counter shown to the person guessing. Self-destruct is irreversible; you can use either, both, or neither.

Plausible deniability, honestly

A decoy vault gives you a believable answer under pressure. It does not guarantee that anyone will believe it, and it cannot hide the fact that you use a vault app. If you want to understand what the concept can and cannot deliver, read plausible deniability explained.

Decoy versus simply refusing

In many coercive situations, the safest choice is to comply and let the photos go; no photo is worth getting hurt over. The decoy vault exists so that complying does not have to mean exposing everything. It is not a reason to escalate or to resist someone who is threatening you.

Checklist before enabling

1. Choose a decoy pattern clearly different from your real one.
2. Fill the decoy vault with ordinary content.
3. Open it once or twice so you know what someone would see.
4. Memorize which pattern does what — write nothing next to the phone.
5. Decide in advance when you would and would not use it, including the legal limits above.