Most vault apps make one mistake that undoes everything else: they announce themselves. A screen that lists “Private”, “Work” and “Hidden” vaults, or a locked folder with a padlock icon, tells anyone looking that there is something worth finding. If someone takes your phone and insists you open it, a visible lock is an invitation to keep pushing.
Sanctum is built around a different idea. There is no list of vaults. The app opens to a pattern grid, and the pattern you draw decides which vault opens.
How hidden vaults work
Every vault in Sanctum is independent. Each one has:
- its own pattern, which no other vault can share;
- its own random 256-bit vault key, encrypting its photos, videos, thumbnails, titles and albums with AES-256-GCM;
- its own recovery code.
When you draw a pattern, Sanctum doesn’t look up which vault it belongs to, because nothing records that. Instead it tries the pattern against every vault at the same time and waits until all of them have finished before showing a result. If one opens, you see that vault. If none do, you see the same “wrong pattern” response as always.
Waiting for every attempt matters. If the app stopped as soon as it found a match, opening your second vault would take slightly longer than your first, and a careful observer could time it. Because every pattern costs the same 600,000 rounds of key derivation for every vault, the wait reveals nothing about which vault matched, or how many there are.
Nothing on screen shows a vault count either. Inside a vault you see only that vault’s photos.
The decoy vault
A decoy is not a special feature, and that is its strength. It is simply a second vault, opened with its own pattern, that you fill with ordinary photos: screenshots, food, a pet, holiday pictures.
If someone makes you unlock Sanctum, draw the decoy pattern. They see a real, working vault with real photos, because it is one. It has its own encryption, its own recovery code and behaves exactly like any other vault. There is no “fake mode” for them to notice.
Make a decoy believable: add photos regularly, and give it enough content that it looks used.
The duress vault (Pro)
A decoy protects you in the moment. A duress vault also protects you afterwards.
Mark one vault as your duress vault. When it is opened with its pattern, it appears like any other vault, and at the same moment Sanctum silently switches off the patterns of every other vault on that iPhone. If someone watched you draw your real pattern earlier, or forces you to try others later, those patterns no longer open anything.
Nothing is deleted. Sanctum replaces each other vault’s pattern wrapper, but keeps the encrypted files and the recovery wrapper untouched. When you are safe, enter each vault’s recovery code, and Sanctum lets you choose a new pattern.
The duress vault only triggers when opened with its pattern, never by a recovery code, so you can still manage it yourself.
Backups that don’t give vaults away
Private Backup saves an encrypted copy of a vault to your own iCloud Drive. It is on by default for your first vault only. For vaults you add later it starts off, because each backup is a separate file, and a second file in iCloud Drive › Sanctum would show that a second vault exists. You can switch it on for any vault if you value the backup more than the secrecy.
Plausible deniability: the honest limits
“Plausible deniability” is often oversold. Here is exactly what Sanctum’s design does and does not hide.
What it hides
- How many vaults you have, from anyone using the app.
- Which pattern belongs to which vault.
- Every vault’s contents, titles and albums, which stay encrypted at rest.
- That a duress vault was used, from what is shown on screen.
What it doesn’t hide
- That Sanctum is installed. A disguised app icon (Pro) changes how it looks on the Home Screen, but the App Library, Settings and storage lists still show the app.
- The number of vault folders, to a forensic examiner. Someone who extracts the app’s storage from an unlocked iPhone could count encrypted vault folders. Their names are random identifiers, with no titles or thumbnails, and they reveal no patterns or contents.
- Anything you leave outside the vault, such as originals still in your Photos library or its Recently Deleted album.
Hidden and duress vaults are designed to keep a casual or pressured look at your phone from going further. They are not a guarantee against a determined forensic investigation, and they are not legal advice. If your safety depends on it, think through your own situation.
To see how the encryption underneath works, start with pattern encryption, or read Sanctum’s security approach.