Decoy profile

Your account can hold two passwords. Your real one unlocks your real vault. A separate decoy password unlocks a decoy vault, a self-contained space populated with fake files you control. To anyone watching you log in, the decoy looks like an ordinary, fully populated account.

This is sometimes called plausible deniability: when handing over a password is unavoidable, you can hand over one that opens something harmless.

In settings, set a decoy password. A few rules keep it credible:

• •It must be at least 6 characters.
• •It must differ from your real password: zcrypt rejects a match so the two vaults stay distinct.
• •You can enable or disable the decoy without deleting it, and remove it entirely whenever you like.

A decoy is only convincing if it looks lived-in, so you add fake files to it: each with a name and a size. These are placeholders that populate the listing to make the decoy vault look like a real one at a glance; they exist to furnish the disguise, not to be opened and read like your real files. Aim for a believable spread of names and sizes: a single test file gives the game away.

At the normal login screen, entering the decoy password signs you into the decoy vault instead of your real one. There’s no separate button or toggle that hints a second vault exists: the password you type decides which vault opens.

• •Dead man’s switch: alert a trusted contact if you stop checking in
• •Authentication & 2FA, passwords, sessions, and two-factor
• •Privacy tools, the feature tour