Some call it the "erase code"; GrapheneOS officially calls it the duress PIN or duress password: a second, secret entry for the lock screen that does not unlock your device — but instantly and irreversibly wipes it.
What the duress PIN actually does
Alongside your normal unlock code, GrapheneOS lets you set a second PIN (or a second password, depending on which method you use to unlock). Enter this code anywhere the device would normally ask for your credentials — on the lock screen, but also at app-internal authentication prompts — and a full wipe starts immediately:
- All of the device's encryption keys are destroyed
- All user data is irreversibly erased
- Installed eSIM profiles are removed as well
- The process runs with no confirmation dialog, no warning, and no countdown
- After the wipe, the device shows the normal initial-setup screen — as if it were brand new
To an observer, entering the duress PIN looks identical to entering a wrong PIN. The device briefly shows "Wrong PIN" and then shuts down. Only by that point the wipe has already fully completed — there is no way to interrupt it or undo it.
What is it meant for?
The duress PIN addresses a very specific threat scenario: physical coercion to unlock the device. This applies, for example, to:
- Border checks where travelers are ordered to unlock their device
- Arrests or searches where the PIN has to be handed over under pressure
- Situations where someone forces you to unlock your device
In moments like these you appear to give in — you enter a PIN — while in the background the device destroys all data. To the person forcing you to unlock, there is at first no way to tell that anything other than a wrong entry has happened.
Where the limits are
The duress PIN is no cure-all. It does not help if:
- the device is already unlocked at the moment it is seized
- a copy of your data exists somewhere else (cloud backup, a backup made earlier)
- someone deploys advanced forensic tools while the device was powered on and unlocked
- you enter the duress PIN yourself by accident — for instance because it is too similar to your real PIN
That last point is the biggest risk in practice. There is no confirmation dialog and no second chance. A duress PIN entered unintentionally wipes your device just as completely as a deliberate one.
Prerequisites before you enable it
Anyone who wants to use the duress PIN should, without fail, first:
- Back up all important data externally (photos, documents, 2FA recovery codes)
- Note down messenger IDs and recovery information separately (e.g. Signal PIN, Session recovery codes)
- Document account logins and password-manager recovery codes somewhere else
- Choose a duress PIN that is structurally clearly different from the real PIN — e.g. a different number of digits, not just swapping individual digits around
GrapheneOS itself explicitly points out that you should never enter the duress PIN just to test it on your everyday device — the wipe is real and takes effect immediately.
Setup (quick overview)
The duress PIN is set up under Settings → Security & privacy → Device unlock → Duress password. To confirm, you first have to enter your current, real PIN. Because GrapheneOS distinguishes between PIN and password unlock, depending on the method you use you may need to set both a duress PIN and a duress password separately, so that the feature reliably kicks in regardless of the unlock method.
A useful addition: Auto-reboot and Lockdown mode
The duress PIN reaches its full potential only in combination with two further GrapheneOS features:
- Auto-reboot: Restarts the device automatically after a configurable period of inactivity (default: 18 hours). After a reboot, storage is fully encrypted and inaccessible without the PIN — not even with advanced forensic methods.
- Lockdown mode: Activated from the power-off dialog, it temporarily disables biometric unlock. After that, only PIN entry is possible — relevant because in some legal systems a fingerprint can be compelled, but a password cannot.
Who is this relevant for?
The duress PIN is aimed at a very specific threat model: people for whom physical coercion to unlock a device is a real scenario — such as journalists with sensitive sources, activists, or people who regularly pass through border checks that involve device searches. For most everyday users, the risk of triggering it by accident is higher than the actual benefit. A strong regular PIN, biometrics disabled in critical situations, and Auto-reboot enabled already provide sufficient protection for most threat models.
All SaferPhone devices run GrapheneOS and support this feature natively — if you need it, our support team will help you set it up safely.