The duress code: what it removes, and how you get it back

What a duress code does

A duress passcode or duress pattern opens your decoy vault and, at the same moment, removes your real vault from this iPhone.

It builds on the decoy vault. The decoy shows a believable vault. The duress code shows the same believable vault and also takes your real one off this iPhone. If someone makes you open the app, your real vault is no longer in Sealed on this phone for them to open. You bring it back later, when you are safe, from your own backup.

If you are in danger, your safety comes first. A duress code can protect your photos, but it can’t protect you, and no setting replaces getting help.

Where your vault goes

Nowhere new. It was already in your encrypted backup, and it stays there.

The duress code removes the vault from this iPhone only: it sends nothing to iCloud, your encrypted backup stays as it is, and Restore from iCloud brings everything back.

So the phone in front of you holds only the decoy, and your real vault waits in your own backup until you bring it home with your recovery key. The backup and restore page walks through a restore.

If you keep an open copy of your vault, it goes too. Entering a duress code deletes this vault’s open copy from iCloud Drive, and leaves the iCloud backup alone.

What it needs before it turns on

Before a duress code can be turned on, Sealed needs a saved recovery key, a decoy vault with something in it, and an iCloud backup that it has just checked item by item.

Each item has a reason:

• The recovery key, because it is what opens the backup later. Without it, the backup is a locked box with no key. Read what the recovery key opens.
• A decoy vault with something in it, because the duress code opens the decoy. An empty vault on screen would look odd.
• A backup checked item by item, because anything not in the backup would be lost for good.

Setting it up

1. Turn on the decoy vault and put a few ordinary things in it.
2. Save your recovery key, and turn on backup if it is off.
3. Once the decoy vault is on, Settings, under Decoy Vault, has a Duress Passcode row, and a Duress Pattern row if you use a pattern.
4. Tap Duress Passcode. The screen lists what is ready and what is not, and checks your backup item by item.
5. Choose the duress code. It has to differ from your real and decoy codes.
6. Turning the duress code on asks for the passcode of your real vault, and Sealed checks your backup once more first.

What it can’t do

Sealed says plainly that the duress code is not a forensic wipe, that anything not yet in iCloud is lost, and that anyone who can make you unlock with Face ID or Touch ID, or who knows your real passcode, still sees your real vault.

Read those limits slowly. The code removes the vault from this phone and nothing else. Sealed’s duress screen says to turn Face ID or Touch ID off for the duress code to help, because anyone who can make you unlock with it sees your real vault.

Anything you added after the last backup finished is not in the backup. If you plan to rely on this, keep backup on and check that it is current. Settings, under Sync & Backup, shows when you last backed up and how many items are backed up. Items you deleted just before the duress code ran, whose deletion had not reached iCloud yet, come back when you restore.

Lock screen styles and the duress code

Choosing Cryptex or Knock replaces your passcode with the word or the rhythm, and Sealed says first if that removes a decoy or duress passcode. If you change to the Cryptex or Knock later, set the duress code up again on the new style, where it is a word or a rhythm like your real code.

Where Sealed helps, and where it doesn’t

It helps when the phone in your hand should hold only what the decoy shows, while your real vault waits in your backup. The duress code removes the vault from this iPhone only: it sends nothing to iCloud, your encrypted backup stays as it is, and Restore from iCloud brings everything back.

It doesn’t do these things:

• Erase every trace. Sealed says plainly that the duress code is not a forensic wipe, that anything not yet in iCloud is lost, and that anyone who can make you unlock with Face ID or Touch ID, or who knows your real passcode, still sees your real vault.
• Save what wasn’t backed up. Anything added since the last backup finished is lost. Before a duress code can be turned on, Sealed needs a saved recovery key, a decoy vault with something in it, and an iCloud backup that it has just checked item by item.
• Stay unknown to someone in your real vault. Anyone who gets into your real vault can see that a duress option exists.
• Stop someone with your face or your real passcode. See the decoy vault page for the same limit.
• Come with the free plan. The duress code is part of Sealed Pro.