How duress codes work
You set two secrets: your real code and a duress code. When someone forces you to unlock, you enter the duress code. To an observer, it unlocks normally. Behind the scenes, the app does something protective.
In VaultBolt (Pro):
- The duress code opens your decoy vault, filled with ordinary photos you are comfortable showing.
- Within two seconds, the main vault's keys are removed from the iPhone, so it cannot be opened on this device.
- There is no dialog, no delay and no message. The timing matches a normal unlock.
- Your encrypted iCloud backup stays, so you can restore later with your recovery phrase.
Decoy only vs duress
| Decoy code | Duress code | |
|---|---|---|
| Opens harmless content | Yes | Yes |
| Real vault still on the device | Yes | No, keys removed |
| Can restore later | Not needed | Yes, from encrypted backup |
Where duress helps
- Someone grabs your phone and demands you open the vault.
- A controlling partner insists on seeing "what's in that app".
- High-risk travel where devices may be inspected (check local law first).
Where it doesn't
- If the person already knows your real code.
- If they watched you set it up, or know the app well enough to suspect a decoy.
- Against a forensic examination that notices storage was recently freed.
Make your decoy believable
An empty decoy invites more questions. Add everyday photos: food, pets, screenshots, a few documents. VaultBolt lets you capture straight into the decoy with the private camera, and a planned "living decoy" will fill it automatically.
Frequently asked questions
Does iPhone have a duress passcode?
No. iOS has no built-in duress passcode. Some Android variants such as GrapheneOS offer one. On iPhone, duress protection comes from individual apps.
What is the difference between a decoy and a duress code?
A decoy code simply opens a second, harmless vault. A duress code opens the decoy and also takes a protective action, such as removing the real vault's keys from the device.
Is using a duress code legal?
Laws differ by country. Deleting data or misleading officials can carry legal consequences in some places. Know your local rules, especially when travelling.
