Start with the threat model, because it is unusual. Most mobile security assumes the attacker has your phone but not you. Disk encryption, forensic extraction resistance, and secure boot all address that case. Duress is the opposite: the attacker has you and the phone at the same time, and can apply pressure ranging from legal authority to physical force. Cryptography does not have a clean answer to a wrench, so these features are all about buying time, reducing exposure, or degrading gracefully rather than defeating the coercion outright.
The Cheapest Real Defense: Force a PIN
Biometrics are the softest part of the chain under coercion. A fingerprint or face can be applied to a sensor without your cooperation, and in many jurisdictions courts have treated compelling a biometric very differently from compelling a passphrase. A memorized passphrase can, in some legal systems, be protected as testimony you cannot be forced to give. A fingerprint is treated more like a physical key.
Both major mobile platforms give you a fast way to drop back to passphrase-only. On iPhone, holding the side button and a volume button (or pressing the side button five times) triggers a mode that disables Face ID and Touch ID until the passcode is entered. Android's Lockdown option, on the power menu, does the same: it hides notifications and requires the PIN or password, ignoring biometrics, for the next unlock. Learn the gesture for your device and practice it, because the moment you need it is not the moment to look it up.
Before any situation where your phone might be taken (a border, a protest, a police stop), power the device fully off or trigger lockdown. A phone that has been off since boot is in its most protected state, with the most keys still encrypted and biometrics disabled until the passphrase is entered. This one habit outperforms most exotic features.
Duress PINs and Wipe-on-Fail: Handle With Care
A duress PIN is a second code that does something protective instead of unlocking normally: wipe the device, boot into a decoy profile, or silently alert a contact. GrapheneOS, the hardened Android distribution, offers a duress PIN or password that, when entered, irreversibly wipes the phone and its eSIMs. Some third-party apps offer decoy modes.
These sound better than they usually are, and it is worth being blunt about the risks. A wipe-on-duress code is dangerous to you as well as the data. If a hostile actor watches you enter a code and the phone visibly wipes, you have just demonstrated destruction of evidence, which in many jurisdictions is its own serious offense, and you may have escalated a tense situation into a violent one. Decoy profiles can be convincing, but a determined examiner who knows the feature exists may keep pushing until the real profile appears, and now you are provably concealing. Wipe-on-fail settings that erase after a number of wrong guesses (iOS offers erase after ten failed attempts) protect against brute force but also mean a child, a glitch, or a panicked mistype can destroy your data.
A destructive duress feature turns your data's safety and your physical safety into the same decision. Sometimes that is the right trade. Often it is not. Decide before you are in the room, not during.
What the Law Does and Does Not Compel
This varies enormously by country, and none of this is legal advice, but the broad shape matters for choosing features. In the United States, the law on compelled decryption is unsettled and split across courts, with a meaningful distinction often drawn between passphrases (which may be protected against compulsion) and biometrics (frequently not). At the border, agents claim broad authority to search devices, and refusing can carry consequences that differ sharply for citizens versus visa holders. In the United Kingdom, the Regulation of Investigatory Powers Act can legally compel disclosure of a key, and refusal is itself a criminal offense.
The practical takeaway is that your defenses should match your actual legal environment. In a place where refusing to disclose a passphrase is a crime, a duress-wipe is legally perilous and a strong argument for simply not carrying the data across that border at all. Which leads to the most reliable technique of the whole set.
The Technique That Beats All of Them: Don't Carry It
No duress feature is as robust as data that is not on the device. If you are crossing a border or entering any environment where coerced unlock is plausible, the strongest move is to travel with a clean phone that holds little, and retrieve what you need from encrypted storage afterward over an authenticated connection. An examiner cannot compel you to reveal what is not there, and there is no destructive action to be caught performing.
This is the same logic that makes account design matter. If your messages, contacts, and files live behind server-side encryption that a fresh install can re-sync after you authenticate, then a wiped or minimal travel device is a full defense rather than a loss. Where a duress code trades your data against your safety, a compartmented setup removes the trade: there is nothing on the phone to protect under pressure.
| Approach | Honest assessment |
|---|---|
| Force passphrase (lockdown / power off) | High value, low risk. Do this by default before any risky situation. |
| Erase after N failed attempts | Good against brute force, real risk of accidental data loss. Only with solid backups. |
| Duress-wipe PIN | Situational. Legal and physical risks can exceed the benefit. Understand your jurisdiction first. |
| Decoy profile | Buys time against casual inspection, weak against an examiner who knows the feature exists. |
| Travel light, re-sync later | The most reliable. Removes the coercion trade entirely: nothing sensitive is present to compel. |
For the surrounding context, our guides on crossing borders with your devices, phone privacy at protests, and the risks of biometric authentication go deeper on the situations where these features actually get tested. The through-line across all of them: encryption defends your data against a lab, but the person in front of you is a different problem, and the best answer is usually to make sure the sensitive data simply is not there to be compelled.