Duress Mode: When Someone Forces You to Unlock

What is duress mode?

A hidden vault can hide the fact that you have more than one vault. It cannot help if someone forces you to draw a pattern and then looks at what opens. Duress mode handles that case. You designate one vault as the duress vault, ideally one with believable but harmless content. When its pattern is drawn, the app opens it with no dialog, sound or delay, and the real vaults are removed from the Mac.

How it works, step by step

1. Setup

   In Vault Settings you mark one vault as the duress vault. The app shows a strong warning and suggests trying it with dummy vaults first.

2. Trigger

   Drawing the duress pattern opens that vault normally. In the background the app deletes every other vault's index, storage files and local recovery entries on this Mac. It does not overwrite them first, because overwriting is unreliable on SSDs.

3. Clean-up

   The recovery database is rebuilt with only the duress vault. Pending backup work is reset and this Mac is cut off from sync, so the deletion is not uploaded as a pile of deletes. Analytics stay forced off.

4. Afterwards

   The duress vault gets a new recovery phrase and its duress flag is cleared. Fresh cover files are written.

What it keeps

• The device salt in the Keychain.
• Your encrypted iCloud backups. A removed vault can be restored one at a time with that vault's own recovery phrase.
• Copies of the vaults on other devices.

That means duress mode protects the data on the Mac in front of the person forcing you. It is not a way to destroy every copy that exists.

What an attacker would have to beat

• A quick look: they see a vault that opens, has content, and shows nothing odd.
• A look at the app's behavior: the unlock shows no warning, delay or dialog.
• A request to open every vault: the real vaults are already gone from this Mac.

What duress mode does not protect against

• Flash storage forensics: deleted data can sometimes be recovered from an SSD. The spec says deletion is without overwrite and says to be honest about that.
• Someone timing the unlock with instruments: a deletion running in the background may change timing or disk activity.
• Metadata: the Keychain item for the duress setting itself is a trace.
• Anyone who images the disk before you unlock: duress mode works only at the moment the pattern is drawn.
• A mistake: drawing the wrong pattern, or a family member playing with the app, can trigger a real deletion. It is irreversible on this Mac unless you have a backup.

Getting it right

• Give the duress vault believable content, so it does not look empty.
• Keep an up-to-date encrypted backup and your recovery phrases on paper before you turn this on.
• Practice with dummy vaults first.
• Think about the legal and safety situation where you live. This feature can change how an authority treats you if they discover it.