How Shadow Layers work
Last updated
Last updated
Shadow Layers are Oten Drive's signature security feature. They exist for one situation ordinary encryption can't handle: being forced to unlock.
A Vault is an encrypted container opened with a password. What most people don't see is that a vault can hold more than one Shadow Layer — independent, fully separate layers inside the same vault. Each layer has its own password, its own keys, and its own files.
When you unlock the vault, which layer opens depends only on which password you type.
One prompt, many destinations. The vault always asks for a password the same way. One password opens a decoy layer; another opens your sensitive layer. Nothing hints that a second layer exists.
Visually identical. Once inside, every layer looks and behaves like an ordinary vault — no badges, labels, or "this is the real one" indicators.
Undetectable. There is no list, counter, or setting anywhere that reveals how many layers a vault has.
There is no "real vs fake" label on these layers — they are independent, and you decide what lives in each.
Independent encryption. Each layer is its own encrypted slot with its own keys. Knowing one password cannot decrypt, derive, or even detect another layer.
Hidden by design. The unlock experience is identical no matter which password you enter. An observer can't tell that more than one layer exists — or prove that it does.
Local verification. Passwords are checked on your device against the encrypted data itself. The server never sees a password and cannot say how many layers a vault has.
You decide. A common pattern: keep believable, low-risk documents in a decoy layer (the one you'd open if compelled) and your real sensitive files in another layer. Because a vault can hold several layers, you can even keep a plausible "second" layer to reveal under sustained pressure while a third stays hidden.
Next: Create a Shadow Layer · Use Shadow Layers · Unlock under inspection · Limits & recovery