Plausible Deniability in a Photo Vault

1. The phrase, and what we actually claim

"Plausible deniability" is a borrowed phrase. In app marketing it is usually left vague on purpose. We would rather say exactly what we mean, because an exact claim can be checked and a vague one cannot.

Here is the exact claim. Obscura Photo Vault keeps ten locked vault files on your phone at all times. Someone who copies those files, and can only read them, is not expected to work out which ones hold a real vault and which have never been used. The technical name for this is resistance to offline slot enumeration. In plain words: the files do not give away how many vaults you use.

Everything on this page follows from that sentence. Section 4 is the part to read most carefully. It is where the protection stops.

2. How it is built

The usual way to build a "hidden" second vault is a flag. A flag is a marker somewhere in the app's data that says this vault is real, or this one is a decoy. That fails the moment someone reads the data, because the flag is the answer.

There is no flag here. Instead:

All ten slots are real vaults

When you first open the app, it fills every unused slot with a complete, valid vault file. Each one gets its own random data, its own locked key, its own real but empty database, and its own random padding. We call them decoy slots only because you never set a password for them. On the phone, they look the same as a vault you use every day.

Unused slots have real passwords too

Each unused slot is locked with a password the app creates from a secret stored on your phone. The point is that "empty" is never shown by something being missing. Every slot has a password, whether or not you chose it.

File sizes are randomised

Every vault database is padded out to a random size between 2 and 15 megabytes. Without this, file size alone would give away which vault has photos in it.

The app never shows a list of vaults

Inside the app there is no list of vaults, no count, and no way to switch between them. Your password opens one vault, and that vault is all you see. This matters. Even the best design fails if the screen ever says "Vault 2 of 4".

Photos are stored in one shared pool

Encrypted photos and videos from every vault are stored together in one folder, under random file names. The folder does not group files by vault. Each file is locked to one vault's key. So a decoy vault cannot claim photos that are not its own, and cannot be made to show them.

3. Why unlocking is slow on purpose

Timing can leak the answer. Suppose the app tried each slot in turn and stopped at the first match. Then a vault in slot 2 would open faster than one in slot 9. Someone timing the unlock a few times could work out the layout.

So the app never stops early. Every unlock tries every slot, including all the unused ones, and only decides once it has finished all ten.

This is why unlocking takes a moment. The delay is deliberate. The same is true of turning your password into a key, which is also slow on purpose. Both delays are the visible price of the protection above.

4. Where it stops

Four known limits. We publish them because you cannot judge whether this feature suits you without them.

4.1 The photo file count

Adding extra photos to the decoy does not fix this. The comparison is on total counts, not on matching individual files. This limit only affects someone with direct access to the phone's storage. From inside the app, there is no way to see it. An open decoy shows its own photos and nothing about any other slot.

4.2 More than ten vaults

Ten slots always exist. If you create an eleventh vault, the app has to create an eleventh file. That extra file is itself the giveaway. Someone counting vault files sees eleven where the app normally has ten.

This is a real trade, and the app leaves it to you. If organisation matters more to you than this protection, you can create more vaults. If this protection is why you chose the app, stay within ten.

4.3 iCloud Keychain

The secret used to create the passwords for unused slots is shared between your devices through iCloud Keychain. That keeps the unused slots consistent across your iPhone and iPad. The cost is this: someone who can sign in to your Apple Account, with iCloud Keychain turned on, could use another device to work out those decoy passwords. Against that one person, the protection does not hold.

We made that trade for consistency across devices. If that person is who you are worried about, the security paper suggests turning off iCloud Keychain on the device.

4.4 The app is visible

Nothing here hides the fact that Obscura Photo Vault is installed. The app shows on your home screen and in your Apple Account purchase history. This protection is about the files on the phone. It does not hide that you keep private photos.

5. What it is actually good for

The everyday situation this solves is common. Someone is holding your unlocked phone, or asks to see your photos, and you would rather show them something than refuse.

Because the app has no list of vaults and no count, opening a second vault with a different password shows a real, working vault with real photos in it. There is no empty screen, no "decoy mode" label, and nothing on screen that hints another vault exists. The person sees an app being used normally, because it is.

That is the whole of it. It is a useful protection for a situation many people actually face. It is not more than that.

6. What it is not

We want to be direct here. This is the area where vault apps tend to hint at a lot and promise nothing.

It is not a defence against a person who insists. It is a property of files on the phone. It does not help against someone watching you type, someone who knows the app has more than one vault, or someone who simply keeps asking. Software cannot solve a situation like that. Any app suggesting it can is overselling.

It is not legal advice, and not a tool for legal situations. We make no claim about how this feature works with any legal process anywhere. Nothing here should be read as guidance for one. If you have a legal question, ask a lawyer, not an app developer's website.

It is not a replacement for the encryption. The protection that does the real work is that your files are encrypted with a key made from a password you chose. The vault slots sit on top of that. If you had to keep only one, keep the encryption.

7. Common questions

What is plausible deniability in a photo vault app?

It means the data stored on the phone does not show how many vaults hold real photos. In Obscura Photo Vault the exact claim is narrower. Ten vault files always exist, all of them valid, so someone reading those files is not expected to tell which ones are in use. It gives you doubt in your favour, not a guarantee, and it has known limits.

How does a decoy vault work?

You create a second vault with a different password and fill it with photos you do not mind showing. The app has no list of vaults and no count. So opening that password shows a real, working vault with real photos, and nothing that hints another vault exists. It is a real vault, not a fake one. That is exactly why it works: there is nothing fake to detect.

Does a decoy vault hide everything?

No, and the limits are published. Someone who can read the phone's storage directly can count the photos in an open decoy and compare that with the total number of photo files on the phone. If the numbers differ, other vaults have photos in them. Creating more than ten vaults also adds an extra file that gives itself away. And the app itself is never hidden.

How many vaults should I create?

Two is the usual answer: the one you use, and one holding photos you are happy to show. Stay at ten or fewer if this protection is the reason you chose the app.

Does the app know which vault is the real one?

No. There is no such thing inside the app. A password opens whichever slot it fits. There is no marker saying this one is real, which is exactly why there is nothing for someone reading the files to find.

Can someone tell how many vaults I use by looking at the app?

Not from the app itself. There is no list, no count, and no way to move between vaults. The known ways to work it out are in section 4, and all of them need direct access to the phone's storage.

Why publish the weaknesses?

Because a limit you do not know about is one you cannot plan around. And a claim with no stated limits cannot be checked. The limits are in the security paper in more technical detail.