A browser is not a VPN. A decoy passcode hides tabs on the device. It does not hide your IP address from sites you visit or from your network operator. Tracking protection is list-based and not absolute. Private Browser Incognito is rated 17+ for unrestricted web access and is intended for adults. The decoy is optional Stealth Suite, not part of the free lock.
App Lock answers a simple request: keep the real session closed. A decoy passcode answers a harder one: unlock something that looks empty while the real tabs stay put. That second request shows up on shared phones, borrowed devices, and any moment when refusing to open the app is itself a signal.
Stealth Suite is the optional kit for those moments. The decoy is the feature people mean when they ask for a second browser that shows nothing. This article stays inside what the shipping product does: a second passcode, a clean session, no sign of Stealth Suite in that session, and the neighboring tools (panic, break-in log, self-destruct, vault) without turning the page into a thriller. If you are still choosing a private browser on architecture, start with The Best Private Browser for iPhone: What Actually Matters.
Why a second passcode exists
A six-digit App Lock with Face ID is free. It is enough when the threat is a roommate, a colleague, or a child picking up the phone, and the right response is that the app does not open. The passcode is never stored. It becomes the key. Forgotten passcodes cannot be recovered. If you forget it, data sealed under it is permanently inaccessible. That rule applies to the real lock and should be read twice before you pick a code you will not remember.
Sometimes closed is not an acceptable answer. Someone asks you to unlock the browser. You need a session that is safe to show: no open tabs from the real session, no downloads, no settings trail that advertises extra features. A second code that opens a different scene is how that request is handled without mixing the two worlds.
The decoy is not a disguise icon. Icon colors in Stealth Suite recolor the shield: Midnight, Ocean, or Ember. Same mark, your color. There are no calculator, notes, or weather disguise icons in the shipping app. If you need the app to look like another utility, that is a different product, and it is not this one.
The decoy is also not a VPN. Handing over an empty browser does not change what sites already saw, and it does not change your IP. It changes what is on the screen now. Keep those layers apart so the feature does not get sold as invisibility.
What the decoy shows (and what it hides)
Entering the decoy passcode at the lock screen opens a clean, empty browser. Real tabs stay hidden. There are no downloads in that session, no settings trail, and no sign Stealth Suite exists in the decoy. The person holding the phone can browse in a fresh window that looks like a first launch. They are not looking at your actual tabs.
That empty window is still a real web browser, rated 17+. It can load pages. It is not a fake UI that crashes on purpose. If someone uses the decoy to visit a site, that visit has the same network limits as any other visit: the site sees an IP address, blocking is list-based, and nothing about the decoy makes the user anonymous. When they return the phone, you unlock with the real code and the real session is where you left it.
The decoy does not display vault files. Private Downloads in Stealth Suite stream into AES-256 storage, with no plain copy on disk, excluded from backups. Session erase does not clear the vault, and the decoy does not open it. That is the point of a second scene: the kept files stay behind the real key.
Do not treat the decoy as a confession booth. A person who already knows this app offers a decoy may infer that a second code exists. The feature hides the session. It does not erase the public description of the app. Use it for borrowed-phone moments, not for fantasies about undetectable software.
How it differs from App Lock
App Lock has one real outcome: the real browser opens, or it does not. Face ID can stand in for the code when you enabled it. Wrong attempts are a lock problem. In Stealth Suite they can also become a log, a photo, or a wipe, depending on what you turned on. The decoy is a third outcome: a plausible empty browser.
You should be able to say which code is which when you are calm. Mix them up and you will open the real session when you meant the empty one, or you will fail to open anything. We cannot recover a forgotten real passcode. We also cannot tell you which code you intended. Write the distinction down in a place that is not the phone if you must, and understand that anyone who finds that note has a map.
Lock without a decoy is the right default for most people. The free product already includes no history file, on-device blocking, one-tap erase, HTTPS-Only Mode, and App Lock. Stealth Suite is for phones that get borrowed, grabbed, or searched, when privacy from websites is not the only audience. The checklist for websites is still a session with no history file plus on-device ad and tracker blocking. The decoy does not replace those. It sits on top when a person is in the room.
Panic, logs, self-destruct, and the rest of Stealth Suite
A panic code is a different second (or third) number. Entered at the lock screen, it silently wipes tabs, the entire vault, and the break-in log, then opens what looks like a fresh start. That is irreversible. Erased data cannot be recovered, by you or by us. Do not configure a panic code you will type by accident. Do not configure one you will forget is destructive.
The break-in log records timestamps on failed unlocks. Optional Intruder Photo uses the front camera to capture who tried. Photos are encrypted on the device. Camera permission is asked when you enable the feature, never at the lock screen. Photos may depict other people. You are responsible for using that in line with local law. Intruder Photo is off until you turn it on.
Self-destruct fires after too many wrong codes. Saved tabs are destroyed, and optionally the vault with them. An intruder who is guessing gets an empty browser. You also get an empty browser. This is not a drill with an undo button.
Prices are fixed in the facts we publish: monthly $4.99, yearly $19.99 with a 7-day trial, lifetime $49.99. The subscription group display name is Stealth Suite. Purchases go through Apple and subscriptions auto-renew until cancelled. If a subscription lapses, protections you already enabled keep working and the vault stays accessible. New downloads that require an active unlock follow the lapse policy in the terms. We do not hold the vault hostage. We also do not invent other price points.
What this is not
A decoy is not anonymity. Sites you opened in the real session already had their logs. Your network operator already had destinations. On-device blocking still does not catch every tracker. The 17+ rating still means unrestricted web access. The decoy does not make those facts milder.
It is not a password manager, not Tor, not fingerprint spoofing, and not an Android or desktop feature. It is not a calculator icon. It is not a way to recover a forgotten real passcode. It is not a cloud sync of hidden tabs. There are no accounts and no app server for browsing. The App Store privacy label remains Data Not Collected. We cannot show a decoy session we never received, and we cannot unlock yours.
Use the decoy when the audience is a person with the phone in their hands. Use erase when you want the real session gone. Use the panic code when you want the vault gone too. Use blocking when the audience is a page. Private Browser Incognito is iOS only. The decoy lives in that app, behind Stealth Suite, on top of a free lock and a forgetful engine. Hand the phone over, open nothing that matters, take it back, and continue.
Private Browser IncognitoFree on the App Store. No history, on-device blocking, one-tap erase.
Get the app
Frequently asked questions
What is a decoy passcode?
A decoy passcode is a second six-digit code. Entering it at the lock screen opens a clean, empty browser. Real tabs stay hidden. There are no downloads, no settings trail, and no sign that Stealth Suite exists in the decoy. Hand the phone over and the person sees a normal, unused session, not the one you were actually in.
Is the decoy browser free?
No. App Lock with a six-digit passcode and Face ID is free. The decoy passcode is part of Stealth Suite, optional Apple IAP: monthly $4.99, yearly $19.99 with a 7-day trial, or lifetime $49.99. If a subscription lapses, protections you already enabled keep working and the vault stays accessible.
Can someone tell that Stealth Suite exists from the decoy?
The decoy is built so there is no sign Stealth Suite exists in that session. It opens a clean, empty browser: no real tabs, no vault contents, no settings trail that advertises the paid kit. A determined person who already knows the product exists can still know that decoys are a feature of this app. The decoy hides your session. It does not rewrite the App Store listing.
What happens if I forget the real passcode?
The passcode is never stored, not even hashed. It is the key. Forgotten passcodes cannot be recovered. If you forget the real code, data sealed under it is permanently inaccessible, by you or by us. There is no reset email. Choose a code you can remember, and treat that irreversibility as a feature with a cost.
What is the difference between App Lock and a decoy passcode?
App Lock is one code (and Face ID) that opens the real session or keeps it closed. A decoy is a second code that opens a different, empty browser while the real tabs stay hidden. Lock is free and is enough when you only need to keep the app shut. The decoy is for when you must unlock something that looks harmless.