Behind the scenes
What a Decoy Vault Can and Cannot Do, and How Velum Builds One
By the llcloud team 5 min read
Quick answer
A decoy vault is a second vault that opens with a different pattern, so you can show it when someone insists on looking. In Velum each pattern opens its own vault and nothing in the app lists or counts them. A duress pattern opens one vault and removes the keys to every other vault on the phone. A decoy cannot hide that Velum exists, needs ordinary photos to be believable, and a duress wipe cannot be undone.
A decoy vault answers a specific worry: someone is standing next to you and wants to see what is in your vault. Saying no may not be an option. A decoy lets you open something real that is not the thing you are protecting. It sounds simple, and the hard part is making sure the app itself does not give the game away. Here is how Velum does it, and where the idea stops working.
How do extra vaults work in Velum?
Each pattern opens its own vault. When you add a vault, which is part of Pro, you draw a new pattern and get a new 9 word recovery phrase for it. The two vaults share nothing you can see. Opening one shows nothing of the other, not even that it exists.
The usual way to do this would be a list: vault one opens with this pattern, vault two with that one. We did not want that list to exist, because any list can be found. So unlocking works the other way round. When you draw a pattern, Velum turns it into a key, as described in how Velum encrypts a photo, and works out the name of the key file that pattern would have. Then it simply checks whether a file with that name exists.
If it does, that file opens the vault. If it does not, Velum says "not recognised". There is nothing to look up, so there is nothing to leak.
Why is there no list of vaults anywhere?
Because a count is as revealing as a list. If the app stored "3 vaults" anywhere, in a settings file, a crash report or an analytics event, someone could read it and know you had not shown them everything. So we built Velum so that nothing counts or names vaults in readable form.
A few of the details that keep it that way:
- Cover files are always there. The folder of key files always holds a set of random cover files that open nothing. One vault or five, the folder looks the same.
- Every block looks alike. Photos, thumbnails and each vault's index are stored in blocks of the same size with random names. Which blocks belong to which vault is recorded only inside each vault's own encrypted index.
- Wrong patterns all look the same. A wrong pattern costs the same wait whatever was drawn, and the wait grows after five tries. Velum never shows an empty vault for an unknown pattern, so a typo cannot be mistaken for a vault, and a guess cannot be told apart from a near miss.
- Settings live inside each vault. Anything that differs between vaults is kept in that vault's encrypted index, never in the app's shared settings.
- Our telemetry cannot see them. The anonymous usage events Velum sends carry no count, no name and nothing that differs between vaults.
- Backups stay quiet too. The Google Drive backup in Pro uses the same flat set of files whatever the vault count, so Drive learns nothing either.
This is also why "more vaults" is a Pro feature rather than a number. The app cannot count your vaults, so the free tier cannot cap them at two. Adding a vault is the gate.
What does the duress pattern do?
The duress pattern, also part of Pro, is for the moment when showing a decoy may not be enough. It is a second pattern for one vault, usually the one you would show someone. Drawn under pressure, it opens that vault exactly as usual. In the background, it removes the keys to every other vault on the phone.
Without its keys, a vault cannot be opened, so the photos in it are as good as gone from that phone. We remove keys rather than files on purpose. Overwriting files on flash storage proves very little, because the phone decides where data really lands. A missing key is final in a way a deleted file is not. The other vaults' blocks stay behind as unreadable data that looks like every other block, and Velum tops the cover files back up, so neither the key folder nor the storage shrinks in a way someone could notice.
The free folder backup mirrors the vault, so the next time it runs after a duress wipe, the backup loses those keys too.
What can a decoy vault not do?
We would rather say this plainly than let a feature promise more than it does.
- It cannot hide that Velum exists. Anyone who knows Velum knows hidden vaults can exist. A disguise can hide the icon, but a determined person who knows what to look for may still find the app and guess what it can do.
- It needs ordinary photos. An empty decoy, or one with three pictures, is not convincing. Put everyday photos in it, the kind you would not mind showing, and use it now and then.
- The duress pattern cannot be undone. Removed keys cannot be restored, by you or by us. The recovery phrases of those vaults stop working on that phone. Only a backup made before the wipe still opens them, with that vault's own pattern or phrase.
- Older backups are out of reach. A duress wipe reaches the folder backup the next time it runs. Copies of a backup you made somewhere else earlier stay exactly as they were.
- It does not protect an open vault. If the phone is handed over unlocked with your real vault open, no decoy helps. Velum locks when the screen turns off, when you leave the app and when you lay the phone face down.
- It cannot stop someone watching. A pattern someone saw you draw opens that vault for them, decoy or not.
Our advice inside the app is the same as here: set the duress pattern on the vault you would show someone, keep ordinary photos in it, and pick a pattern you can draw calmly.
Where does this fit with other ways to hide photos?
Most people never need a decoy. If you mainly want photos out of your gallery, start with our guide on how to hide photos on Android. If you are deciding between vaults, how to choose a photo vault app covers what to look for, and are calculator vault apps safe explains what a disguise does and does not add. Built-in tools take a different approach, which Velum vs Samsung Secure Folder looks at in detail.
Sources
Questions
What is a decoy vault?
A second vault that opens with a different pattern. If someone pressures you to open your vault, you draw the decoy's pattern and they see whatever you put there. In Velum, extra vaults are part of Pro. Each one has its own pattern and its own recovery phrase, and opening one shows nothing of the others.
Can someone tell how many vaults are in Velum?
Not from the app or its files. Velum keeps no list of vaults, and its storage looks the same whether you have one vault or several. What nobody can hide is that Velum supports extra vaults. Anyone who knows the app knows another vault could exist, so a decoy works best when it looks lived in.
What does Velum's duress pattern do?
It is a second pattern for one vault. Drawn under pressure, it opens that vault as usual and, in the background, removes the keys to every other vault on the phone. Those vaults cannot be opened again on that phone. Only a backup made before still opens them, with that vault's own pattern or phrase.
Can a duress wipe be undone?
No. Once the keys are gone, neither Velum nor we can bring them back, and the recovery phrases of those vaults stop working on that phone too. A backup made before the wipe still opens them. The next folder backup after the wipe follows the phone, so it cannot open them either. That is the point of the feature, and also its cost.
