Daily use

First boot: the setup wizard

After you flash and boot WraithLink, it applies its safe defaults and then offers WraithLink Setup. The wizard is guided but every step is optional - you can skip any of it and return later from the app icon. It walks through, in order:

A strong screen lock (the root of your disk encryption).
The duress (panic) credential.
Auto-reboot and auto-wipe.
Blocking USB while locked.
Disabling 2G.
Enabling Mullvad encrypted DNS.
Creating WraithVault.
Backing WraithVault up - before you arm the decoy destroy.
Installing apps (and, optionally, sandboxed Google Play).

Living with three credentials

Use your normal PIN every day. Keep the decoy-duress PIN and the panic credential memorised and distinct, and practise entering the decoy PIN so it's second nature under stress - because to an onlooker it must look exactly like a normal unlock. Remember that arming the decoy destroy without a current WraithVault backup means a real, unrecoverable loss if it fires.

Using WraithVault

Switch into WraithVault the way you switch profiles, give it its own strong lock, and put your sensitive apps and data there. Keep your everyday profile genuinely used - real messages, real photos - so it remains a believable front. Back the vault up regularly to X47 or an encrypted USB-C drive.

Apps and updates

Install open-source apps from F-Droid, or turn on sandboxed Google Play from the wizard to use Play-store apps in a sandbox with no special privileges. System updates arrive automatically over the air and install in the background; you just reboot when prompted.

The Tor "Ghost" profile

For anonymous browsing or messaging, switch to the Tor profile, where traffic is routed through Tor and Tor Browser is ready to go, isolated from your everyday identity.

If a network won't connect

If you can't get online on public Wi-Fi, it's usually strict encrypted DNS versus a captive portal. Turn Private DNS off in Settings, complete the login page, then turn it back on. See network privacy.