A duress password is a second password you set beside your real one. Type the real one and the phone or app opens normally. Type the duress one and something else happens: on GrapheneOS the phone wipes itself; in some password managers a dummy database opens. In HushHush, the duress password either opens a decoy HushHush with its own contacts and conversations, or wipes the real one. Real and decoy are encrypted identically, so nothing on disk says which is which.
Where duress passwords exist today
The idea is older than smartphones. Alarm panels have long had a duress code: it appears to disarm the system but silently calls for help. The phone version keeps the shape and changes the action.
The best-known phone implementation is on GrapheneOS, a hardened Android for Pixel phones. Its features page describes a duress PIN or password that, once entered, irreversibly wipes the device along with any installed eSIMs. It works anywhere the device asks for its credential, not only on the lock screen, needs no reboot and cannot be interrupted. There is no decoy: the only outcome is a wipe.
A standard iPhone has no duress passcode. Its nearest setting is Erase Data, which Apple describes as erasing all information, media and personal settings after ten consecutive failed passcode attempts. That is a defence against guessing, not a code you choose and type on purpose.
Password managers took the other road. Strongbox, a KeePass app for iPhone, lists a Duress PIN among its features; its users describe three outcomes when it is typed: open a dummy database, show a technical error, or remove the database from the app. So there are two families of duress password: the kind that destroys, and the kind that shows something believable instead. HushHush offers both and lets you choose.
| Situation | A normal app | With HushHush |
|---|---|---|
| You are made to type your password | Everything opens | The decoy opens, or the real HushHush is wiped |
| Someone inspects the app's data on the phone | Readable once the phone is unlocked | Encrypted; real and decoy look the same |
| Who you message, and when | Yes | Still yes, in the carrying app |
| Photos, email and other apps on the phone | Open | Still open. HushHush protects only itself |
| Getting the data back after a wipe | Maybe, from a backup | No. Wipe mode is permanent |
Who this is for
A border crossing with the phone you also use for work. A partner or relative who insists on seeing your messages. A robbery where you are told to unlock. A journalist whose sources would be exposed by one open chat list. None of these people are spies, and all of them share one moment: being watched while they unlock, with no way to refuse. That moment is what a duress password is built for.
Choose the mode for the day you are picturing. Decoy mode suits being watched and then let go: something plausible opens and the real HushHush stays closed. Wipe mode suits a phone that will be taken away and examined at leisure: there is nothing left to examine. Be clear-eyed about the second one. A wipe is permanent, and HushHush has no server and no backup of its own to restore from.
How HushHush helps
HushHush keeps your messages, contacts and keys in one encrypted store on your phone, opened by your password, which is never stored. A duress password is an optional second password for that store. In decoy mode it opens a separate HushHush with its own contacts and conversations and leaves the real one untouched and locked. In wipe mode it destroys the real one and leaves the decoy in its place. Both are encrypted with the same four-cipher cascade, so a copy of the phone's storage shows encrypted data of the same kind and nothing that marks one as real. Both people still need the app, pairing still happens once, in person, and the carrying app still sees only ciphertext.
Set a second password
In HushHush's settings, add a duress password. Make it as easy to type under stress as your real one, and different enough that you never mix the two up.
Choose decoy or wipe
Decoy opens a separate HushHush with its own contacts and conversations. Wipe destroys the real one for good. Pick the one you could live with on a bad day.
Practise it
If you chose decoy, open it once in a calm moment and give it some life: a thin decoy convinces nobody. If you chose wipe, there is nothing to rehearse.
What HushHush does not do. It protects what is inside HushHush, not the rest of the phone: photos, email and other messaging apps open as usual for whoever holds the unlocked phone. If you are forced to unlock under observation, a decoy only helps if it is believable. Wipe mode destroys the real HushHush permanently, with no recovery. The carrying app still shows that encrypted messages were exchanged, with whom and when, and HushHush itself is visible on the phone. The rules on refusing to unlock a device, and on destroying data someone has asked for, differ by country; this page is not legal advice.
Frequently asked questions
Does iPhone have a duress passcode?
What is the difference between a duress password and a decoy password?
Can a decoy be detected?
Is it legal to use a duress password?
A second password for the day you need one.
HushHush is on the App Store and Google Play. Pair in person, then send in any app.
Related
Sources
- Features: Duress PIN/Password, GrapheneOS, accessed 7 October 2026.
- Set a passcode on iPhone (Erase data after 10 failed passcodes), Apple Support, accessed 7 October 2026.
- Strongbox - Password Manager (Duress PIN option), App Store listing, accessed 7 October 2026.
- Duress PIN for the paranoid (#778), Strongbox issue tracker on GitHub, accessed 7 October 2026.
- Duress code, Wikipedia, accessed 7 October 2026.