<- All posts
Aug 17, 2026

The Best Duress Code Is the One You Never Need

A GrapheneOS duress PIN can make your data effectively unrecoverable in seconds—but at a border crossing, that may create a much bigger problem than the one you were trying to solve. From forensic realities to potential legal consequences, this is why wiping a device under pressure is very different from simply refusing to unlock it.

I had a friend ask me about using a duress code on his Android phone running GrapheneOS as a 'Forensics Guy'. He was a recent n00b at DEF CON, hacker summer camp, and was a little stressed on his return trip across the border.duress-code.png

A duress password is a feature for when you're under duress, and someone is demanding access to your entire digital life. Instead of your real password, you enter a duress code, and it immediately wipes the device leaving only forensic traces of being factory reset. It does this by deleting the cryptographic key, followed by a profile wipe, followed by a restart, which destroys any possible hope of retrieving the data. It's gone for good.

In the US, triggering a wipe like this during a border search, has already led to federal charges (destroying property to prevent its seizure). In Canada, it's arguably a little worse. Wiping a device mid search can fall under the Customs Act as interfering with or molesting an officer! An offence that most likely will land jail time and fines up to $25,000. That said, not a good idea as most CBSA officers have stated that refusing to provide the password and wiping your device are two very different acts, and refusable will not land you in jail.

It is hard to argue with a feature whose real-world use so far has been turning its owner into the accused. The feature is designed for one narrow scenario, an adversary who wants your data and can't compel the courts BUT, the actual people demanding your phone at a border are the courts proxy and against them, a wipe doesn't defeat the search, it will upgrade your charge sheet straight to some hot water.

The panic under duress angle makes it worse. The whole premise is you'll flawlessly recall and enter a decoy password while someones leaning on you, the one moment when your memory is least reliable. Fat finger your real PIN as the duress PIN some ordinary morning and, poof, all your data is gone.

The best duress feature is not having anything to be duress'd about in the first place.

So, the moral of the story is, the best security control is the one you never have to trigger, because you didn't bring the risk with you in the first place.