Hidden Vaults: One Pattern, One Vault, No List
Hidden vaults let one Mac hold several separate vaults. Each pattern opens only its own vault, and no screen lists them. If you draw a pattern that matches nothing, Hidden Folder opens an empty vault instead of showing an error. Nothing is saved until you add a file.
What are hidden vaults?
Most vault apps show a visible locked box. Anyone who opens the app can see that something is being protected, and can ask you to open it. A hidden vault avoids that. The app has no vault list, no vault count and no "wrong password" message. Each pattern simply opens whatever vault it belongs to, or an empty one.
How it works, step by step
- Draw pattern
- Derive candidate key
- Test every vault index
- Match: open it
- No match: empty vault
-
You draw a pattern
The app derives a candidate key from it, the same way it does for pattern lock.
-
It tests the key against every vault
Each vault has an encrypted index. The app tries to open all of them. The authentication tag of AES-GCM tells it which one, if any, belongs to this key.
-
A match opens that vault
You see that vault and nothing else. Other vaults stay sealed and invisible.
-
No match opens an empty vault
The empty vault exists only in memory. It is written to disk as a new vault only if you add a file to it and your plan allows another vault.
How files are stored so vaults stay separate
- All vaults share one folder of files with random names. A file name does not say which vault it belongs to.
- The app adds cover files, which are random padding blobs, to blur how many real files each vault holds.
- Each vault's index is an encrypted file that looks like every other index. The app cannot tell them apart without the right key.
- The folder is excluded from Spotlight.
What an attacker would have to beat
- Casual snooping: nothing on screen proves a second vault exists.
- Someone who knows the app is installed: they can make you open a vault, but cannot tell whether it is the only one.
- Someone who inspects the disk: they see encrypted files of various sizes and encrypted indexes, with no label saying which is which.
What hidden vaults do not protect against
Plausible deniability here is best effort, and the spec says so. A skilled examiner with time and tools can still learn some things.
- Ciphertext sizes and file timestamps are visible on disk.
- Counts are blurred by cover files, not hidden.
- Timing differences could in theory leak information to someone measuring with instruments. The app tries every index each time to reduce this.
- An attacker who simply forces you to disclose every pattern. No software fixes that.
Frequently asked questions
How do I know which vault I opened?
Each vault has a name you can rename in Vault Settings. The default is a random six-letter code. The name only shows after you unlock.
Can I see a list of my vaults?
No. That is the point. If you forget which patterns you used, you have to try them, or use your recovery phrase for each one.
Does an empty vault take up space?
No. It exists in memory until you add a file. Then it is saved as a real vault.
How many vaults can I have?
The planned free plan allows 3. The planned paid plan removes the limit. These numbers are placeholders until pricing is final.
Is this the same as duress mode?
No. Hidden vaults keep vaults separate. Duress mode goes further: one pattern also erases the others on that Mac.
References
Try hidden vaults on your Mac
Coming soon. Join the waitlist and we email the link.
Get early access