What Is a Duress Password? Uses, Limits and Legal Risks

A duress password is a second password you use only when someone forces you to unlock: instead of opening your real data, it opens a harmless decoy, triggers a silent alert, or erases the sensitive data. It is an old idea from alarm systems and bank vaults, now available in some apps. It can help in a narrow set of situations, it has real practical limits, and in some contexts using it is illegal. Treat it as a last-resort tool, not a guarantee.

How a duress password works

There are three common designs:

1. Decoy: the duress password opens a believable but harmless version of the content (a few vacation photos instead of your real vault).
2. Erase: the duress password destroys the sensitive data, often while showing a decoy so nothing looks wrong.
3. Alert: the duress password unlocks normally but notifies someone, as some home alarm systems do.

Many tools combine the first two. The goal isn't to resist forever; it's to end the situation with the least harm.

What iPhone offers natively

iOS doesn't have a duress passcode. The closest built-in features are:

• Emergency SOS: press and hold the side button and a volume button. This brings up the Emergency SOS slider and temporarily disables Face ID until the passcode is entered. Useful if someone might force your face toward the phone.
• Erase Data: in Settings > Face ID & Passcode, turn on Erase Data to wipe the phone after 10 failed passcode attempts. It protects against guessing, not coercion.
• Stolen Device Protection: adds biometric checks and delays for account changes. See how to protect photos if your phone is stolen.

None of these give you a passcode that opens something harmless. That's why duress features appear in individual apps, not the system.

When a duress password can help

• Coercion by someone without technical resources: a controlling partner, an acquaintance, a mugger who wants to "see what's on the phone." A decoy ends the demand without revealing what you were protecting.
• Situations where you can't refuse but the stakes are personal, like private documents or family photos you never agreed to show anyone.

When it doesn't help, or makes things worse

Be honest with yourself about these limits:

• Forensic copies come first. A professional examiner usually images the device before asking you to unlock anything. Erasing data afterward then achieves nothing, except possibly making things worse for you.
• People who know the app may suspect a decoy. If an app is known to support duress codes, an empty or thin vault can look suspicious. A decoy needs believable content.
• Escalation. If someone notices the data changed, the situation may get more dangerous. Your safety matters more than any photo.
• Legal exposure. In many countries, deliberately destroying data during a police search, a border inspection or a legal proceeding can be a crime (destruction of evidence, obstruction), even when the data itself was legal. Some border agencies can also search devices without suspicion and hold the device if you refuse.

Duress features you may already have elsewhere

The idea isn't unique to phone apps. Home alarm systems often support a duress code that disarms the siren while silently alerting the monitoring company. Some encrypted-disk tools offer hidden volumes behind a decoy password. Some banks let you set up alerts for unusual withdrawals. In every case the principle is the same: give the person applying pressure something that looks like compliance, and limit the damage.

How to set one up well, if you decide to

1. Make the decoy believable. Put real, harmless photos in it. Add to it occasionally.
2. Make the duress secret easy to recall under stress, but different from your real one.
3. Practice once in a calm moment so you know what happens.
4. Back up first. If the duress action erases data, the only copy you'll have is your backup.
5. Decide in advance when you would and wouldn't use it. Under stress, people default to what they've rehearsed.

How sigil.'s decoy vault works

sigil. uses the decoy design, not the erase one. The decoy vault is a vault with harmless photos you chose, opened by its own decoy pattern, drawn on the same 5×5 grid. Drawn under pressure, it opens only the decoy vault and erases nothing. Because sigil. keeps hidden vaults with no visible list, the decoy looks like any vault; nothing on screen indicates that another one exists, and inside the decoy counters and limits refer only to the decoy. It's free and off by default. sigil. also has no Face ID unlock, on purpose: someone can hold a phone up to your face, but the vault opens only with a pattern you draw.

What it can't do: it can't stop someone who copied the phone's storage beforehand, it can't make anyone believe you, and it can't hide that you use a vault app. Since the decoy pattern erases nothing, your real vault is still on the phone, encrypted and hidden, and nothing is lost if you draw the decoy by mistake. And again: we don't recommend using it against authorities.

The decoy pattern is for coercion, where you are the one drawing. Guessing is a different threat. For that, sigil. has an optional, free self-destruct: if someone tries too many wrong patterns within a time window, the vaults are erased, with no warning or counter shown to them. It's off by default and irreversible.

Duress versus plausible deniability

A duress password acts at the moment of coercion. Plausible deniability is a broader property: an observer can't prove that hidden data exists at all. The two often work together, but they're not the same. We explain the second in what is plausible deniability encryption.

The short version

A duress password is a narrow, useful tool for personal, low-tech coercion. It isn't a shield against forensic examination or legal process, and using it in those settings can create bigger problems than it solves. Set it up thoughtfully, keep backups, and put your safety first.