What is a duress password, and do you need one?

What "duress" means here

Most security assumes an attacker who doesn't know your password. Duress is the other case: the person in front of you can make you unlock. They might be someone you live with, someone checking your phone at a border or a party, or someone who simply won't give it back until you open an app.

In that moment, refusing can make things worse, and a normal lock gives you only two options: open everything or open nothing. A duress password adds a third option. You appear to comply, the app opens, and what the other person sees is ordinary and boring.

How a duress password usually works

The details vary by app, but the idea is the same everywhere:

1. You set a normal password (or pattern) that opens your real data.
2. You set a second, different duress password.
3. When the duress password is entered, the app opens a harmless space, and in many designs it also hides, locks or removes the sensitive data from the device.
4. Nothing on screen says a duress code was used. To the person watching, it looks like an ordinary unlock.

Some apps only show a decoy. Others also delete local data. The second type is stronger under pressure, but it only makes sense if the real data has a backup that the other person can't open, otherwise you lose it for good.

Duress password vs decoy vault vs disguised icon

These three features are often mixed up. They solve different problems:

A disguised icon alone is the weakest of the three, because it hides the app, not its contents. We explain why in are calculator vault apps safe? The real protection always comes from encryption; duress and decoy features decide what you reveal when you can't say no.

When a duress password is worth it

• You share a home with someone who checks your phone. A partner or relative who insists on looking can be shown a vault of normal photos.
• You carry sensitive documents. Scans of IDs, medical papers or legal documents that would cause harm if someone forced you to open them. Our guide on storing passport and ID scans on iPhone covers where to keep them in the first place.
• You travel or attend events where phones get grabbed. Being able to "unlock" quickly can end a tense moment.
• You've been pressured before. If it has happened once, planning for the next time is reasonable, not paranoid.

If none of these apply, a strong, unique passcode and an encrypted vault are usually enough. A duress setup adds steps you have to remember, and a feature you forget about can surprise you at the wrong time.

The limits you should know

A duress password is a tool for a specific situation, not a promise. Be realistic about what it can't do:

• It can't fool everyone. Someone who knows the app, or who has seen you open the real vault, may keep asking. A duress code buys you a plausible answer, not immunity.
• It doesn't defeat forensic analysis. A person with time, tools and your device may find signs that other data existed, even if they can't read it.
• It doesn't help if you're watched. If someone saw you enter your real code, they can enter it too. Cover the screen when you unlock.
• It doesn't protect unencrypted copies. If the same photos sit in your camera roll, a shared album or an unencrypted backup, the duress code doesn't touch them. Delete the originals after moving them; our guide on permanently deleting photos from iPhone walks through Recently Deleted and iCloud.
• Removing data has a cost. If the duress action deletes vaults from the device and you have no backup, they're gone.

How to set up a duress password well

1. Make sure the real data has a backup. Confirm your backup is working and that you hold whatever you need to restore it, such as a recovery phrase, stored somewhere the other person can't reach.
2. Fill the decoy with believable content. An empty vault looks suspicious. Add everyday photos: food, screenshots, a pet, receipts. If you add real photos, strip their location first with our free metadata remover.
3. Choose a duress code you can enter under stress. Make it different from the real one but just as easy for you to remember. Panic makes complicated codes hard to recall.
4. Practise once. Try it while nothing is at stake, then restore your real data from backup. You'll know exactly what happens and how long recovery takes.
5. Keep the real vault out of sight elsewhere. Check that notifications, widgets, recent files and the camera roll don't reveal what's inside the real vault. Our guide to locking and hiding apps on iPhone covers the places apps tend to show up.

How the duress pattern works in Hushkeeper

Hushkeeper, which makes this site, is built around the same ideas. Every pattern opens its own vault, and the unlock screen never lists them, not even how many there are. With Pro, you can set a duress pattern: it opens one vault as usual and removes every other vault from the device.

The removed vaults aren't lost. Their encrypted iCloud backups stay in your iCloud and can be restored later with each vault's recovery phrase. Because files are encrypted on the device with AES-256-GCM before they're backed up, the copy in iCloud is ciphertext that only your recovery phrase can open. That's why step 1 above matters so much: keep your recovery phrases written down and stored away from the phone.

Hushkeeper is also open about its limits. It can't protect you from someone watching you draw your pattern, and if you lose both your pattern and your recovery phrase, nobody can recover the files, not even us. Hushkeeper is coming soon to the App Store.

Quick checklist

• Real data is encrypted and backed up, and you know how to restore it.
• Recovery phrase or backup key is stored away from the phone.
• Decoy vault holds believable, location-free everyday photos.
• Originals are deleted from Photos and Recently Deleted.
• You've practised the duress code once and restored afterwards.