How does a duress PIN differ from a decoy PIN?

In Sealby every PIN opens its own vault, so a decoy is simply a harmless vault you choose to show. A duress PIN goes further: it opens that decoy and removes your other vaults from that device. An ordinary decoy leaves those vaults in place; duress removes their local copies. Restore only data backed up beforehand, using each vault’s recovery phrase.

Is a duress wipe reversible?

Backed-up data can be restored if the backup completed before the wipe and you have each vault’s recovery phrase. Sealby stops syncing on that device before removing the other vaults, so their existing encrypted iCloud backups remain. A phrase cannot restore unbacked-up changes. Setup lets you proceed without iCloud backup only after you explicitly accept permanent data loss; that warning does not create a backup.

Will anyone notice a duress PIN was used?

The app behaves like a normal unlock into the visible vault. There is no alarm, no message, no different animation. Whether the absence of expected data is later noticed is situational — a duress wipe is for moments where that trade is acceptable.

Should everyone set up a duress PIN?

No. It is a serious tool for people with a concrete coercion risk — border crossings with sensitive professional material, hostile domestic situations, activism under pressure. If your risk is a snooping friend, deniable vaults alone are the right tool and a wipe PIN is unnecessary risk of self-inflicted data loss.

What does duress code mean?

A duress code is a secondary PIN or passcode that appears to unlock a system normally while triggering a protective action. Depending on the system, that action may open a decoy, send an alert, or destroy encryption keys.

Does iPhone have a built-in duress passcode?

No. iOS has Emergency SOS and other safety features, but it has no built-in passcode that opens a decoy or wipes selected private data under pressure. People instead use a prepared decoy, an app-specific feature, or a separate safety plan; Sealby’s optional duress PIN (Premium) opens a harmless decoy vault normally while removing your other vaults from the device.

What is a duress PIN? Panic codes and last-resort wipes explained

What is a duress PIN — and when does it make sense?

A duress PIN looks exactly like your normal code, but entering it does something protective instead — in Sealby’s case, opening a harmless decoy vault and removing your other vaults from that device. Here is how the idea works and how to think about it.

By MartinJuly 27, 2026 2 min readUpdated September 23, 2026

Protecting files under pressure

Sealby

Different PINs can reveal different vaults

Open your real vault, a harmless decoy or an empty vault. In the normal app interface, opening one does not list the others.

See how hidden vaults work

A locked phone

Strong until it is unlocked

A device passcode protects the phone, but one successful unlock exposes the apps and accounts inside it.

A standard vault app

Adds a second lock

Useful against casual access, though the app may still reveal that protected content exists.

Travel with less data

Often the safest preparation

Remove anything you do not need before a border crossing or other high-pressure situation.

The idea: a code that answers pressure

Coercion works because unlocking is binary: either you refuse (visible defiance, escalation) or you comply (full disclosure). A duress code adds a third path: you comply — visibly, cooperatively — and the system does something other than full disclosure. The person watching sees a normal unlock.

Alarm systems have used this for decades (a panic code that opens the door and silently calls for help). Applying it to encrypted storage is newer, and the action attached to the code differs by system: open a decoy, notify someone, or destroy material.

Device removal is not the same as destroying every copy

"Wiping" can mean overwriting data, deleting encrypted blocks, or destroying keys. Those are different operations with different limits. Encrypted systems can avoid overwriting gigabytes by removing local keys or encrypted copies. What matters for recovery is whether a usable copy and its recovery credentials survive elsewhere.

Sealby opens the decoy, stops syncing on that device, and removes the other vaults from the phone. Existing encrypted iCloud backups are not deleted by that operation. Restore each backed-up vault on a fresh install with its own recovery phrase. Backup must have completed beforehand: recent changes that never reached it cannot be restored. If iCloud backup is off, setup warns about permanent loss and requires your explicit acknowledgement before enabling duress. That acknowledgement is not protection against losing data.

The trade-offs, honestly

A duress PIN carries two real risks. You can trigger it yourself — mis-entering a PIN you chose to be plausible — which is why it must be a deliberate, distinct code you rehearse but never use casually. And its protection is removal: if the coercer expected specific data, its absence may itself escalate the situation, and in some jurisdictions removing data during a lawful search can be treated as obstruction. Decoy vaults handle the cases where showing something is safer than showing nothing.

Sealby offers ordinary decoy vaults without removing anything, and an opt-in Premium duress feature that removes the other vaults from the device. Before relying on duress, complete your backups and keep each recovery phrase somewhere safe. Neither approach guarantees that a coercive person will be satisfied or that a situation will de-escalate.