Sealby
Different PINs can reveal different vaults
Open your real vault, a harmless decoy or an empty vault. In the normal app interface, opening one does not list the others.
See how hidden vaults workDeniability & duress
The duress password felony: when deleting your data becomes the crime
Deleting phone data during a search raises questions beyond whether a copy can be recovered. A decoy vault may limit what the app reveals, but it cannot guarantee that other clues will go unnoticed, that a request for access has been fulfilled, or that the encounter will be safe. This article explains the technical differences, not your legal obligations.
Protecting files under pressure
A locked phone
Strong until it is unlocked
A device passcode protects the phone, but one successful unlock exposes the apps and accounts inside it.
A standard vault app
Adds a second lock
Useful against casual access, though the app may still reveal that protected content exists.
Travel with less data
Often the safest preparation
Remove anything you do not need before a border crossing or other high-pressure situation.
What happened at the border
In July 2026, The New York Times reported on a US citizen stopped at the border and asked to unlock a phone. The code typed in was, prosecutors say, a duress password (also called a duress PIN) — a special passcode that erases the device instead of opening it. What followed was a federal felony charge for destroying evidence: the first known case of its kind, still undecided, and a new light on every panic-wipe feature in any product.
Why deleting can be worse than showing
The charge rests on a simple idea: if officials have the right to examine something, destroying it while they wait looks like shredding documents during a raid — and an erased phone cannot prove its own innocence. There is a practical problem too, far beyond borders: a wipe is visible. One moment the data exists; the next, right in front of the person demanding it, it is gone. Whether that person is an official, an abusive partner, or a thief, visible destruction tends to escalate the moment, not end it.
What a decoy vault does—and does not—show
Different codes can open different Sealby vaults. You can keep ordinary content in one vault, and Sealby stores no vault list or count that directly announces the others. This limits what the app reveals; it does not prove that no other clues exist or guarantee how someone demanding access will react. Lock any sensitive vault before handing over the device: already-open content or copies elsewhere can be viewed. Opening an ordinary decoy that has not been configured to trigger duress does not delete your other vaults. That technical distinction is not a claim that you have fulfilled a legal demand for access.
Sealby’s duress PIN: local removal, completed backups retained
Sealby offers an optional duress PIN: mark a harmless decoy vault, and opening it removes your other vaults from that device, once. Sync stops before removal, so completed encrypted iCloud backups remain. Restore each backed-up vault on a fresh install with its own recovery phrase. This does not upload anything at the moment of duress, and any changes not already backed up are lost.
A backup does not remove the legal risks
A completed backup can preserve data after Sealby removes its local copy; merely enabling backup cannot guarantee that everything has uploaded. That technical difference is not a legal shield. Removing data during a search can carry legal risks, and this article is not legal advice. Get advice appropriate to your jurisdiction and situation. No app feature guarantees that a person demanding access will be satisfied by a decoy.
If the risk is real for you
If your situation calls for a duress PIN, prepare before relying on it: complete the backup, keep each recovery phrase somewhere safe away from the device, stock the decoy with harmless content, and choose a PIN you will not enter by habit. Recovery needs both the phrase and an existing encrypted copy. Consider personal safety and legal risks as well as technical behavior; neither a decoy nor a wipe guarantees a safe outcome.
Quick answers
Is a duress password illegal?
Nobody knows yet — that is exactly what makes this case important. Prosecutors say that wiping a phone during a lawful search destroys evidence, like shredding papers during a raid. The defense says the search itself was improper. No court has decided, and the rules differ from country to country. This article is not legal advice — if this risk is real in your life, talk to a lawyer who knows your jurisdiction.
Does Sealby’s duress PIN delete my data forever?
It removes your other vaults from that phone and stops syncing first, preserving existing encrypted iCloud backups. If a backup completed beforehand, restore its data with the vault’s recovery phrase on a fresh install. Unbacked-up changes are lost. If backup is off, setup requires you to acknowledge permanent loss before it lets you enable duress.
Can someone tell that a duress PIN was used?
Not from the screen. The decoy vault opens like any normal vault — no alarm, no message, nothing unusual. And afterwards, entering any other code shows an outsider what it always showed: nothing. The duress PIN works once, then switches itself off until you set it up again.
Is wiping your phone destruction of evidence?
Removing data during a search can carry legal risks. No app feature can determine whether an action is lawful in a particular situation: a backup does not change what happened on the device, and showing a decoy does not guarantee that a request for access has been fulfilled. This is not legal advice; seek guidance appropriate to your jurisdiction and circumstances.
Does my duress setting copy to my other devices?
No. It is set up on each device separately and never travels with your synced data. Your iPhone can have a duress PIN while your iPad has none.
Your vault is waiting.
Download Sealby and protect what matters. Setup takes under a minute, and there’s no account to create.
Download on the App Store
iPhone & iPad · iOS 17+ · Free