Question 1

How does DeniableOS protect me when someone forces me to unlock my phone?

Accepted Answer

Under coercion you enter the Public PIN. The phone unlocks to a real, lived in profile: contacts, photos, social apps, browsing history. There is no visible second OS, no encrypted partition that a forensic tool can point at. The vault, your real data, stays mathematically invisible until you enter the Hidden PIN. A Duress PIN is also available: if entered, it silently wipes the vault while still opening the public environment. The attacker sees a working phone either way.

Question 2

Can a forensic tool prove the hidden vault exists?

Accepted Answer

No. The hidden vault is encrypted and occupies storage that, to a forensic tool, appears as random noise, the default state of unused encrypted storage. Statistical analysis cannot distinguish the two. This is the core of deniable encryption theory; the construction follows the Canetti, Dwork, Naor, Ostrovsky framework on plausibly deniable encryption.

Question 3

What is the three PIN system?

Accepted Answer

DeniableOS uses three PINs. The Public PIN unlocks your visible daily use environment, a real profile with real apps. The Hidden PIN unlocks the hidden vault where your actual data lives: crypto wallets, seed phrases, encrypted communications, anything you would not want a customs officer or attacker to find. The Duress PIN, entered under coercion, silently wipes the vault while opening the public environment so the attacker still sees a working phone. Failed PIN attempts are invisible: the phone gives no signal that more than one PIN exists.

Question 4

Is deniable encryption legal where I live?

Accepted Answer

In most jurisdictions, yes. Some countries, notably the UK (RIPA) and Australia, have disclosure laws that require surrendering encryption keys on demand. Deniable encryption is built for exactly these cases: you surrender a key that unlocks the public environment, which is a fully functional phone. A cooperating user genuinely cannot prove they have surrendered the last key, because there is no last key visible. Read the jurisdiction guide before international travel.

Question 5

What stops someone from just guessing the Hidden PIN?

Accepted Answer

The PIN is rate limited by the hardware secure element on the Pixel, the same chip Android uses for biometric storage. After a small number of failed attempts the phone enforces increasing delays. Combined with a strong Hidden PIN, brute forcing the vault offline is computationally infeasible.

Question 6

Which Pixel models are supported?

Accepted Answer

Pixel 6, 6 Pro, and 6a, Pixel 7, 7 Pro, and 7a, and Pixel 9, 9 Pro, 9 Pro XL, 9a, and 9 Pro Fold are fully supported (Tensor G1, G2, and G4). Pixel 8 (Tensor G3) and Pixel 10 (Tensor G5) are not supported. See /install for the live device matrix.

Question 7

How does the install work?

Accepted Answer

In short: verify your Pixel is supported and unlock the bootloader, run the installer to flash DeniableOS, then set your PINs during the guided setup. The /install page walks through every step.

Question 8

What does the installer erase?

Accepted Answer

Flashing replaces the device's operating system, so anything on the phone before flashing is gone. Back up photos, two factor seeds, authenticator apps, and any local files first. Your carrier SIM keeps working. Google Pay and Play may need to be set up again inside the public environment after flashing.

Question 9

What happens if I forget the Hidden PIN?

Accepted Answer

If you forget the Hidden PIN, the vault is unrecoverable by design. There is no recovery phrase and no backdoor: if recovery were possible, the data would not be deniably encrypted.

Question 10

How does payment work, and what does DeniableOS know about me?

Accepted Answer

Card payment is handled by Stripe. Your license activates your device against our licensing server. We keep your account and license details limited to what billing and support require.

Question 11

Is there a refund if my device is not compatible?

Accepted Answer

Yes. Full refund within 14 days if the installer fails on a supported device. Use your order and license key to request it.

Question 12

Do you collect telemetry from the installed OS?

Accepted Answer

The OS does not collect analytics, crash reports, or feature usage. It does contact our servers to validate your license and to check for updates. DeniableOS specific debug logging is stripped from release builds.

Question 13

Is DeniableOS open source?

Accepted Answer

DeniableOS is built on GrapheneOS and AOSP, which are open source. The DeniableOS specific layer that adds the dual environment and the deniability features is currently closed source and requires a license.

Question 14

How is this different from GrapheneOS?

Accepted Answer

GrapheneOS is an excellent hardened Android. Its duress PIN wipes the device, which leaves an obviously wiped phone, and that is itself suspicious. DeniableOS shows a fully functional, lived in public environment under coercion. To an attacker, a wiped phone reads as 'this person had something to hide and destroyed it', while a lived in public environment reads as 'this is just their phone'. The threat model is different: DeniableOS is designed for situations where the existence of hidden data is itself the danger.

Question 15

Who is DeniableOS built for?

Accepted Answer

Three groups primarily. Crypto holders whose holdings make them targets for coercion, including the physical attacks on holders that have made headlines. International travelers, journalists, activists, and business people, facing border device searches that can copy a phone without a warrant. And professionals whose confidentiality is structural: lawyers, doctors, whistleblowers, anyone whose work depends on data surviving coercion.

Questions, answered.