Discretion for Sale: Inside the Privacy Apps Built to Hide Your Secrets

The Rise of Vault Apps

Vault apps, which are also called decoy apps and ghost apps, present themselves as the dullest thing on a phone, such as a calculator, clock, compass, audio manager, or an antivirus scanner. Behind a PIN, however, sit photos, videos, notes, message threads, and, in some cases, entire applications that don’t appear on a phone’s home screen.

Some vault apps take a silent front-camera photo of anyone entering a wrong PIN. Some support two passcodes, one opening the real vault, one a sanitized decoy stocked with holiday pictures. Make no mistake, these apps don’t occupy some fringe corner of the app stores; the titles that researchers have tested carry 10 million to 100 million-plus installs apiece.

Why the App Library Undoes the Icon

When the researchers ran a test of vault apps, they did so from the position of someone with no technical skill and only a few minutes holding the phone. They had no issues downloading and using the applications.

Not all vault apps are disguised, however. Of the 20 apps examined, only 10 offer a disguise. The rest simply announce themselves as vaults. Of those 10, seven had a decoy that actually worked as the app it pretended to be. Only five of those switched the disguise on automatically at installation, meaning the rest sat in plain sight until someone remembered to hide them. Going further, only three of the 20 kept the disguise consistent in the phone's app library. That means 17 of the 20 tested apps show one name and icon on the home screen and a different one in the settings list.

Then there is the size. A working calculator needs about 6.10 MB. The smallest calculator-disguised vault in the study occupied 35.17 MB before a single file was added to it, with one groowing from 72.09 MB to 237 MB once the researchers stored a photo, a video, and a text file inside. 

A calculator, perhaps obviously, does not need a quarter of a gigabyte This means you can check for potential vault apps by opening a phone’s Settings, scrolling the full application list, and comparing it against the home screen. Duplicate utilities, an implausible storage figure, and mismatched names are the three tells. Our walkthrough of hidden apps on iPhone covers the platform-specific version of the same sweep. Be aware, however, that you should not go through someone’s phone without permission. Doing so carries both ethical and legal implications.

The Lock Is Weaker Than the Disguise

Only five of the 20 apps applied any encryption to the files they stored. The rest relied on tricks like dropping files into hidden folders, changing file extensions, or rewriting a few header bytes so an image won't open on a double-click. This requires nothing more exotic than Android's standard developer tools; the researchers, for example, pulled the stored files out of 15 of the 20 apps without rooting the phone. For seven of the apps, the PIN and account recovery email sat in storage in plain text.

This matters most for whoever has the strongest reason to use a vault app. The study framed its threat model around phone searches during civil unrest and intimate partner violence, moments when a device is handed over under pressure. A survivor storing documentation in a fake calculator is trusting a disguise that breaks in two minutes and encryption that mostly isn't there.

Finding A Vault Proves Less Than It Feels Like

A vault app is a container. One’s existence says nothing about what that container stores. 

People install them to keep photos away from a repair technician, to store passport scans and medical records, or, as is becoming increasingly common, because a teenager wants privacy from a parent. Teen ownership is effectively universal now, with 95% of U.S. teens reporting access to a smartphone, so the potential audience for a vault app is enormous. 

The stakes are not always low. In November 2015, administrators in Cañon City, Colorado uncovered several hundred explicit images circulating among more than 100 students, stored in a photo vault that presented itself as a working calculator. The district attorney ultimately declined to file charges.

That said, leap from icon to conclusion is where people get this wrong in a relationship. A hidden app sits alongside the softer signals, such as a phone turned face-down, a changed passcode, or several messages from a name you've never heard. None of these signs of cheating resolve on their own, meaning your best course of action is to have a calm, adult convesation. If the pattern you're actually noticing is subtler, our piece on micro-cheating may help you figure things out. You could also check out our piece on what apps cheaters use, which covers the disappearing-message and second-account tools that live outside the vault category, or get a few tips on finding hidden social accounts, which are far easier to surface than a locked vault.

Check the Person, Not the Phone 

Without the PIN, you cannot open a locked vault app. Guessing at it is likely to trigger an intruder photo or alert, and if you’re doing this on a phone that isn't yours, it may be illegal. The vault itself is often a dead end, which is why you might want to ask less about the app and instead find out more about who owns it and why.

You can do that part using the public record, which is legal. You can run an unfamiliar number from a call log, for example, through a reverse phone lookup to see what public web pages and records tie to it (our guide to reverse phone lookups explains what those results do and don't include). An unrecognized email goes through an reverse email lookup, while name with nothing behind is a fit for a people search. On a related note, if you’re wondering whether someone is potentially being unfaithful to their husband or wife, you can read our article on how to find out if someone is married.

If a photo is the only thing you have, a reverse image lookup checks whether that picture appears elsewhere on the public web under a different name. This is the the method behind reverse image searching a catfish. Make sure to remember that a clean result is no longer proof, especially in the age of AI, as romance scammers increasingly use generated photos that don’t appear online. ClarityCheck searches public sources; it does not perform facial recognition, verify identities, or track devices, and results vary by what those sources hold.

Regarding vault apps, always keep in mind that a disguised icon tells you someone wanted privacy. Everything you can actually verify requires somewhere else.