Plausible Deniability in Apps, Explained Simply
Plausible deniability means someone looking at your app cannot prove there is more inside than what you showed them. In a photo vault, it usually means decoy vaults: a second secret opens a believable, harmless vault, and nothing reveals the real one.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- Hiding is not the same as deniability. A hidden folder is still visibly there to anyone who looks.
- It must hold up when someone checks the files. No list, no labels, no counts.
- It has limits. Someone who knows the app supports decoys may keep asking.
What does plausible deniability mean?
It comes from a simple idea. If you are made to unlock something, you can unlock a version that looks complete. The other data is encrypted and looks like random noise, or does not show at all.
Disk encryption tools have offered hidden volumes like this for years. Some messaging and vault apps now offer the same idea in a simpler form.
Why does it matter?
The risk most people face is not a lab cracking encryption. It is a person who says "open it". That could be a partner, a parent, a thief with your passcode, or an official at a border.
Strong encryption alone does not help in that moment. You either open it or refuse. Deniability gives you a third option: open something believable.
What does an app need for real deniability?
- A different secret opens a different space. Not a setting that toggles a decoy mode.
- No list of vaults anywhere. Not in settings, not in a menu, not in an "about" screen.
- Every vault encrypted with its own key. Otherwise the files give the game away.
- The decoy looks like the real thing. Same screens, same speed, same features.
- Storage that does not count your vaults. File names, sizes and slots should not reveal how many exist.
How does Cryptile do it?
Cryptile opens a different vault for each pattern you draw. A pattern you have not drawn before opens a new, empty vault. There is no vault list. See decoy vaults.
- Each vault's key is derived from its pattern on your device. Every file is AES-256-GCM encrypted.
- File sizes are padded, and spare slots, some holding random data, hide the vault count.
- Someone who copies the app's files sees an upper limit on vaults, not the real number.
- With Plus, a panic pattern destroys this device's keys. No vault opens until you restore from your 9-word recovery phrase.
Where does deniability stop working?
Our threat model lists these openly:
- The app is visible. Anyone can see Cryptile is installed, and may know it supports decoys.
- Total size shows. A 10 GB vault is visibly not a 10 MB one.
- Write timing. File change times can hint at activity. Cryptile touches the spare slots on every write to blur this.
- An empty decoy looks odd. Put real, ordinary photos in it and use it now and then.
Is it legal to use a decoy?
Using a decoy app is ordinary. Giving a false answer to police or border officials can be a crime in some places. This is not legal advice. If that situation is likely, talk to a lawyer first.
What this doesn't protect against
Deniability fails if someone saw you draw the real pattern. It does not hide that the app exists or how much space it uses. Malware on an unlocked phone can read whatever vault is open.
Do it with Cryptile
In Cryptile, a different pattern opens a different vault, and there is no vault list. Keys come from your pattern on your device; there is no account and no server.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos. That is enough to set up one decoy. Plus adds more decoy vaults and the panic pattern for $19.99 a year (7-day free trial) or $39.99 once.