What a hidden vault profile actually protects against — and what it doesn't

Vaultherit's hidden profile is one of its least-understood Pro features, partly because it's easy to assume it works like the other unlock methods. It doesn't — and the difference is the whole point.

It's not a sixth key to the same door

Master password, recovery phrase, hardware key, M-of-N, and family password all do the same job: each independently wraps its own copy of the one 256-bit vault key that encrypts your data. Unlock with any of them and you're in the same vault. The hidden profile works differently on purpose — it's a second, wholly separate vault, with its own independent encryption, indistinguishable from the primary one at the unlock screen. There's no way to tell, just by looking at the lock screen, whether a hidden profile even exists.

What that's actually for

The scenario it's built for is coercion — being made to unlock your vault under pressure — not an attacker quietly guessing your password from a distance. You unlock the visible profile, which can hold real but less sensitive data, while whatever you've placed in the hidden profile stays provably undetectable from the lock screen itself.

Where it stops — said plainly

Vaultherit's own security documentation is direct about this: the hidden profile "exists to make a second vault indistinguishable from the primary one, but that's mitigation, not immunity." It doesn't protect you if someone already knows a hidden profile exists and specifically demands it. It doesn't help if your device already has malware running while the vault is unlocked. And like every unlock method, it's only as strong as the password protecting it — Argon2id slows down guessing; it can't turn a weak password into a strong one.

The honest way to think about it

Treat it as one layer in a broader design, not a silver bullet. The same vault also supports M-of-N multi-factor, so no single leaked secret is enough on its own, and a family password held by someone else entirely. The hidden profile's specific job is narrow — deniability at the lock screen — and it does that one job well, without being sold as more than that.

See the full unlock architecture — how every method wraps the same vault key via BLAKE2b — on the Security page.