How can I design a secure login flow for my mobile app with a secret diary feature?

I'm curious why you’ve gone with the fake diary approach at all. It's somewhat problematic to route users differently based on their password input. A better method might be to focus on robust user authentication so you don't need this honeypot strategy.

Using Cognito or Google for your identity provider (IdP) won't work for this scenario since they won't handle the second password and don’t even know the original password. If you want this dual diary access, you’ll probably need to create your own IdP. Honestly, I would recommend rethinking your approach to align more closely with the tools you're using without complicating things too much.

This feels like a classic case of creating a solution for a problem that doesn't really exist. Just be wary of where this could lead. I hope this isn’t becoming a trend where gimmicky features like these are paired with AI-generated concepts that might divert from providing real value.

This concept may not be practical long-term, but if it’s more of a fun side project, here's an idea: Log users in normally with Cognito and only show the real diary. Then, add a feature to unlock the real diary with a password input; if it matches, display the real diary, otherwise show the fake one. You could use the password as an encryption key—store a hash (like with argon2d) and keep the diary content encrypted. This way, losing the password would mean you can't decrypt the real diary, which aligns with how secure encryption apps work.

Storing the fake diary locally and using a second password to unlock it might be a simpler solution. Why keep the fake diary on your servers when you can just manage that locally? It could streamline your design while still keeping the function you want!