If you use GrapheneOS, you probably already know that this operating system has a reputation for being a fortress for privacy. But there is a little-known feature that has been generating a lot of noise lately: the Duress Password, or duress password. It is a mechanism that completely erases all the information on your phone by simply entering a specific password, and its usefulness was recently demonstrated in a case that has already reached the US courts.

What is Duress Password and how does it work?

The idea behind this feature is as simple as it is powerful. GrapheneOS allows you to set up a second password, different from the one you normally use to unlock your device, and which you can provide in case of emergency. When someone—whether it's a thief, a border agent, or anyone who wants to force you to unlock your device—asks for the code, you simply enter this alternate key.

What happens next happens in the background and without any visible warning. The system immediately and irreversibly initiates a complete wipe of all data, including the main profile and any secondary profiles you have created: messages, photos, applications, accounts, files and settings. This process also removes installed eSIMs and does not require a reboot, meaning that once it is activated, no one can stop or reverse it.

Setting it up takes just a couple of minutes. You just have to go to Settings, then Security and privacy, then Device unlock and finally Duress Password. There you are asked to confirm your current PIN and create the new emergency key, which should have a different length or format than usual to avoid writing it by accident.

The interesting thing is that this feature is not limited to just the lock screen. It works anywhere in the system where your PIN or password is requested, such as when enabling developer options or confirming security changes. No other mainstream mobile operating system offers anything similar, making GrapheneOS a fairly unique option for those who prioritize shielding their information.

The case that put the Duress Password in the spotlight

The true litmus test for this function came with an episode that began to circulate in the specialized media. As reported by TechCrunch, a US citizen is being investigated after, upon returning to the country, he used his Duress Password to prevent Customs and Border Protection (CBP) agents from accessing the information stored on his phone.

The man handed over the key that the officers asked for, without imagining (or perhaps knowing perfectly well) that this would activate the total erasure of the device in front of them.

The striking thing is that the case did not stop there. US authorities formally accuse him of deliberately deleting his phone during a border inspection, and the matter is already in judicial proceedings. This episode quickly became a reference point to debate how far travelers' rights go in the face of digital inspections at entry points into the country, and how legal it is to use tools like this to protect themselves.

Why this feature is a game changer

Beyond the specific case, Duress Password poses a completely different scenario than what we are used to with traditional mobile security. It is not about choosing between handing over your real password or refusing to collaborate, but rather having a third way that gives you peace of mind without generating a direct confrontation with the person requesting it.

For journalists, activists or simply users concerned about their privacy, this tool represents a huge leap compared to what other operating systems offer. The possibility of protecting sensitive information without raising immediate suspicion is precisely what makes GrapheneOS such a followed project within the digital security community. The legal debate that opened with this case will probably mark a before and after in how the use of this type of functions is interpreted in light of the law.