The idea: a code that answers pressure
Coercion works because unlocking is binary: either you refuse (visible defiance, escalation) or you comply (full disclosure). A duress code adds a third path: you comply — visibly, cooperatively — and the system does something other than full disclosure. The person watching sees a normal unlock.
Alarm systems have used this for decades (a panic code that opens the door and silently calls for help). Applying it to encrypted storage is newer, and the action attached to the code differs by system: open a decoy, notify someone, or destroy material.
How destruction actually works
Naively, "wiping" sounds slow — overwriting gigabytes takes minutes you do not have. Encrypted systems do it differently: destroy the keys, not the data. Sealby’s hidden vaults are encrypted with keys that the duress PIN erases; what remains on disk (and in any synced backup) is ciphertext with no key in existence. That takes milliseconds and cannot be undone by any forensic tool, because there is nothing left to find.
The only path back is a vault’s recovery phrase stored somewhere else entirely — which turns the duress wipe from "data loss" into "data is no longer on this device", if you prepared.
The trade-offs, honestly
A duress wipe carries two real risks. You can trigger it yourself — mis-entering a PIN you chose to be plausible — which is why it must be a deliberate, distinct code you rehearse but never use casually. And its protection is destruction: if the coercer expected specific data, its absence may itself escalate the situation. Decoy vaults handle the cases where showing something is safer than showing nothing.
That is why Sealby treats decoys as the default tool and the duress PIN as opt-in. Deniability de-escalates; destruction ends. Both exist because pressure comes in different shapes.