Duress passcodes explained: How they work and why they can land you in court
AI News Desk
·
ZDNet
··
6 min read
'ZDNET Recommends': What exactly does it mean?
'ZDNET Recommends': What exactly does it mean?
ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.
When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.
ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form .
Follow ZDNET: Add us as a preferred source on Google.
We're used to using PINs and passcodes to protect our tech, but lately people arelearning they can also be used to wipe devices.
This capability is available in duress passcodes -- sometimes referred to as self-destruct passcodes -- and this is what Samuel Tunick , an Atlanta man, allegedly gave to a Customs and Border Protection agent during a stop at Hartsfield-Jackson International Airport in January 2025.
As the name suggests, this is a passcode or PIN that is entered into a device when the owner feels compelled to unlock a device but doesn't want to make the data on the device available to a third party.
For the sake of completeness, there are three different types of duress PIN/passcode:
Here we're going to focus on destructive duress passcodes and PINs for smartphones. Tunick was running the custom operating system GrapheneOS on his Android smartphone, which has had a duress passcode feature since June 2024. Once this feature is activated, if the duress passcode is entered at any point that the phone asks for a passcode, it will wipe all user profiles and any data they contain and wipe the eSIM partition.
Also: I finally tried GrapheneOS on my Pixel, and it's the secure Android alternative I've been waiting for
No reboot is needed, and once triggered, the process can't be stopped.
The feature works on the principle that data that's been securely wiped is the most secure data you can have. It wipes the encryption keys used for disk encryption. With these keys gone, all that's left on the disk is ciphertext, which without the key is essentially unrecoverable with current forensic capabilities.
If you've been looking for the duress passcode feature on your smartphone, I have bad news for you. This is a specialist feature on a specific, privacy-focused and security-hardened version of Android, built by an independent nonprofit that's unconnected to Google.
Stock Android releases and iOS have no equivalent, and there's no app you can install for this feature. If you want this capability, you'll need a smartphone that can run GrapheneOS (all Google Pixel handsets ), and then you'll have to install the OS onto the device .
Many people might feel that a duress passcode could make their life safer, from executives and diplomats traveling in hostile or high kidnap-risk countries, to journalists, activists, and non-governmental organization workers in authoritarian states.
Also: You've been using your power bank wrong, and airline rules make that obvious
I also know people who use this sort of feature for personal safety or peace of mind.
And anyway, it's your data, so why shouldn't you be able to wipe it with a few taps?
Prosecutors have charged Tunick under 18 U.S.C. § 2232 (destroying property to prevent lawful seizure), which carries up to five years' imprisonment. His attorneys are moving to suppress on Fourth Amendment grounds (a warrantless seizure), and a ruling is expected later in the year.
It's not just in the US that using a duress passcode could land you in trouble. In the UK and EU, several laws relate to handing over devices and passcodes similar to the one being tested in the US case, although none have been tested via a duress passcode being triggered.
The GrapheneOS Foundation, a non-profit based in Ontario, Canada, claims that "creating and using GrapheneOS is strongly protected by the US Constitution" and that "laws attempting to make it illegal or require weakening the security would be unconstitutional".
Also: I tested this backup power station during a real blackout - don't make my mistakes
In digging about for similar cases, I came across a German Federal Court of Justice ruling from March 2025 where one legal analysis concluded that compelling a suspect to use a fingerprint to unlock a phone doesn't violate self-incrimination protections because it doesn't require the suspect's "active participation" the way entering a password does.
Interestingly, not even GrapheneOS offers a "duress biometric" feature to get around these types of rulings.
This one is simple -- your data is gone, and your phone is back to factory-fresh state.
At this point, you might have a cloud backup somewhere and a passcode that only exists in your head, or you might have to start from scratch.
That outcome depends on how prepared you are and how much effort you want to put into this sort of security.
If you can't install GrapheneOS, there are a few options available to you, but none as comprehensive as a duress passcode.
You can use the wipe feature built into Android and iOS devices, but this capability isn't as quick or as smooth as using a duress passcode, requires the handset to be unlocked, and won't work if the battery level is too low. There are also remote wipe features built into iOS and Android, which, when activated, trigger a wipe. This capability also requires access to a second device and the time to do it.
There are also apps with built-in duress passcodes. For example, the pro version of Strongbox includes an option to set duress passcodes to open a dummy database or wipe all data in the app.
I happened to be traveling through a North African country (that will remain nameless) that doesn't like drones.
I didn't have a drone, but I had a bag that had a drone maker's name emblazoned all over it. This bag attracted attention at customs as I was leaving. I also had an Apricorn Aegis Secure Key 3z , a flash drive that stands out due to its built-in keypad.
Everything on the drive was encrypted (and I don't think I had anything important on it beyond my travel itinerary and copies of my documents). However, I felt it might be confiscated (in the end it wasn't), and quickly and quietly wiped the device, turning it into a blank drive.
The process was quick, simple, and effective. And my decision didn't cause me any grief down the line.
