If your phone is seized, whoever can unlock it can read every normal messaging app on it, and backups of those chats can be requested from Apple, Google or the app's provider unless you turned on end-to-end encrypted backups. HushHush is different: your messages live in a separate encrypted store on the phone, opened only by your password, which is never stored. It locks itself on a timer, slows down wrong guesses, wipes after repeated failures, and accepts a duress password.
What a seized phone gives up
On most phones the lock screen is the only barrier. Once it is past, the messaging apps open with it, unless you turned on an app lock of their own. So the first question is whether the phone was taken locked or unlocked, and whether whoever has it can get it unlocked.
The second question is the cloud. Apple's iCloud data security overview says that under standard data protection, an iCloud Backup includes a copy of the Messages in iCloud key, and Apple holds it; only with Advanced Data Protection are both the backup and that key end-to-end encrypted. WhatsApp says its backups to iCloud or Google Drive can be end-to-end encrypted with a password or a 64-digit key, so that neither WhatsApp nor the backup provider can read them, but you have to turn it on. Google's Android help page lists SMS and MMS messages and app data among what its automatic backup includes, some of it additionally encrypted with your screen lock.
A copy that sits with a provider can be asked for without the phone. The rules on who may ask, and how, differ by country; this page is about what the technology allows, not what the law permits.
The third question is the other end: every message you sent also sits on your contact's phone, in whatever state their phone and backups are in.
| What | A normal messaging app | With HushHush |
|---|---|---|
| Your chats, once the phone is unlocked | Readable | Still locked behind your HushHush password |
| A copy requested from the cloud | Readable unless encrypted backups are on | There is no HushHush cloud to ask |
| A copy of the app's data taken off the phone | Depends on the phone's own encryption | Encrypted; the key also needs a secret held in the phone's secure key store |
| Who you message, and when | Yes | Still yes, in the carrying app |
| Guessing the password | Depends on the phone's lock | Slows down, then wipes after repeated failures |
| Forced to unlock in front of someone | Everything opens | A duress password opens a decoy or wipes |
Why this matters, and when it does not
A phone holds years of conversation, and it changes hands: a theft, a border crossing, a police stop, a controlling partner, a lost bag. For most people the realistic risk is not a specialist laboratory but a person holding an unlocked phone and scrolling. For a lawyer, a journalist or a doctor, the chats on that phone are other people's secrets as much as their own.
If the phone is taken while HushHush is open and the auto-lock has not yet fired, the conversation on screen is readable, and nothing in HushHush changes that. The carrying app keeps its own copy of the ciphertext, so it still shows that you exchanged encrypted messages, with whom and when. And your contact's phone holds the decrypted messages in their HushHush, under their password, not yours.
How HushHush helps
Nothing inside HushHush is readable without your password. The key that opens your HushHush is derived on the phone from the password, using Argon2id and then HKDF, and the password itself is never stored, not even as a hash: the only way to check a password is to try to decrypt with it. The store locks itself when the auto-lock timer runs out. Wrong passwords meet a lockout that grows with every failure, and after repeated failures the store wipes itself. Add a duress password and a forced unlock opens a decoy HushHush, or wipes the real one. Both people need the app and one in-person pairing.
Pair once, in person
Open HushHush, add a contact, and scan the QR code on the other phone. No account, no phone number, no server.
Set the timer and a duress password
Choose a short auto-lock timer so an unattended phone closes HushHush by itself, and add a duress password that opens a decoy or wipes.
Send through any app
Type in HushHush and paste the ciphertext into any app, or connect Telegram, Matrix or email and it is sent and decrypted automatically. Either way the carrying app holds only ciphertext.
What HushHush does not do. It does not protect a phone that is seized while HushHush is unlocked and the auto-lock has not fired. It does not delete the ciphertext the carrying app keeps, and that app still shows who you wrote to and when. It does not reach your contact's phone: the messages they decrypted are in their HushHush. It does not hide that HushHush is installed. If you turned on Face ID or fingerprint unlock for HushHush, it opens with your face or finger as readily as the phone does; turn that off if this is the risk you are planning for. And whether anyone may demand your password, and what happens if you refuse, differs by country; this page is not legal advice.
Frequently asked questions
Can police read my messages if they take my phone?
Are WhatsApp and iMessage backups encrypted?
Can deleted messages be recovered from a phone?
Does HushHush help if my phone is unlocked when it is taken?
Encrypt it before someone else holds your phone.
HushHush is on the App Store and Google Play. Pair in person, then send in any app.
Related
Sources
- iCloud data security overview, Apple Support, accessed 7 October 2026.
- End-to-End Encrypted Backups on WhatsApp, WhatsApp blog, accessed 7 October 2026.
- Back up or restore data on your Android device, Google Android Help, accessed 7 October 2026.
- Set a passcode on iPhone (Erase data after 10 failed passcodes), Apple Support, accessed 7 October 2026.