Feature
Duress mode
A second pattern that makes this phone forget how to open the others.
Duress mode is optional and off until you arm it. You nominate a second pattern belonging to a decoy vault. Drawing that pattern opens the decoy normally — and in the same moment, this device discards its keys to every other vault on it.
What that actually does
Each vault's key is wrapped twice: once by the pattern and once by the recovery phrase, both inside the same header. Duress overwrites that header, so both routes in close together.
The files stay exactly where they were on disk. They are simply ciphertext that no longer has a key on this device.
What it is not
This is a device discarding keys — not a shredder, and not a forensic wipe. We make no claim about what someone examining the hardware could or could not determine, and a product that does make that claim is worth being sceptical of.
Your backup is the way back
If encrypted backup is switched on when duress fires, the backup is frozen, never deleted: syncing stops so the emptied device cannot overwrite it, and the copy already stored stays restorable. If backup was off, those vaults are gone from that phone for good — and the recovery phrase will not bring them back, because it was wrapped in the same header the pattern was.
Arming is deliberately harder than a toggle
It happens inside the decoy vault's own settings and is confirmed by re-drawing that vault's pattern. If you have no backup, the app says plainly that the recovery phrase will not help and asks you to type a confirmation before it will arm.
Restoring onto a new device, or transferring to a new phone, disarms it automatically — the marker it depends on does not travel.
Available on iPhone, iPad and Android.