Solution: Primary & Secondary account, distinct passwords
This doesn't answer your question directly, but you can probably achieve what you want by using multiple profiles with distinct passwords.
Set the "owner" profile to a very long "boot" passphrase.
Then create a new user profile (
Multiple users ->
Add user). Switch to this user and set a shorter "lockscreen" password.
Now when you boot the phone, in order to access the secondary user's data and apps, you must type the long "boot" passphrase for the "owner" user first, then you must type the shorter "lockscreen" password for the secondary user.
After switched to the secondary user (thereby necessarily having authenticated with both passwords), your lockscreen will be unlocked with the shorter "unlock" password.
If you reboot the device, then you must type both passphrases again. This achieves almost the same end as having FDE with a distinct boot & lockscreen password.
Issue: FDE removed in Android 10
Unfortunately, the solution you're looking for does not appear to be possible because it's not possible to use FDE in Android since Android 10.
According to the ASOP documentation, it is no longer possible to use FDE and the user is forced to use File-Based Encryption
Note: Devices running Android 7.0–9 support full-disk encryption. New devices running Android 10 and higher must use file-based encryption.
More issues: Backups
Unfortunately, the biggest issue with the dual-user approach is backups.
As far as I can tell, both users have distinct files (encrypted with distinct keys that are not shared), apps, and app data.
Moreover, secondary users in Android cannot use
adb or become root. Therefore,
adb backup and tools like
oandbackups will not work because the "owner" user (the only user who can become root) cannot see the secondary user's files/apps/data.
So, if you're google-free, then this solution probably means you cannot backup your phone anymore :(
Update: I was successfully able to restore backups of apps taken on my old phone's "owner" account in
oandbackups and restore them to my new phone's secondary user's account with
oandbackups following this procedure:
- first, uninstall the app if already present
- open oandbackup (as the secondary user, needs root)
- find the package you want to restore, long-click it -> click "uninstall"
- when finished, long-click it again -> restore -> apk (only)
- open the app as the secondary user
- after opening it, run
ls -lah /data/user/10/xyz.tld and make a note of all the owner:group perms of the files
- back in oandbackups, choose "restore -> data" for the package
mv /data/user/10/xyz.tld /data/user/10/xyz.tld.fresh
mv /data/user/0/xyz.tld /data/user/10/
chown abc:xyz -R /data/user/10/xyz.tld to match the permissions of the freshly-installed app for this user
restorecon -R /data/user/10/xyz.tld to fix SELINUX permissions
- reboot the phone (if you don't do this, opening the app will immediately crash)