What to do if someone forces you to unlock your phone

This is about the duress scenario: you are handed your phone, or someone is standing over your shoulder as you unlock it. No app removes the risk in that moment — but HushKeep’s emergency (duress) pattern lets you show one vault and make the others unopenable on the device. Set it up before you need it, and know its limits.

This page is general information about a personal-safety feature, not legal advice. Your own safety comes first; no feature is worth a dangerous situation.

What the emergency pattern does

The emergency pattern is a second pattern that you can draw on the lock screen instead of your real one. When you do:

it opens a decoy vault — a normal-looking vault with ordinary content you prepared in advance;
it instantly destroys the keys to your other vaults on this device;
it works only once: after it opens the decoy vault, the emergency pattern is gone, and the lock screen behaves like any vault lock screen.

The emergency unlock looks the same on screen as a normal one, and the app keeps no list of your vaults, so nothing on screen reveals that anything else existed.

Set it up before you need it (Pro)

The emergency pattern is part of HushKeep Pro. To set it up:

Prepare the decoy vault first. Create it with its own pattern and its own recovery phrase, and fill it with photos and content that would be believable to show.
Open the vault you want to protect. The emergency pattern is set up from inside the vault it protects — that is the vault whose keys it will destroy.
Choose the emergency pattern. Draw a distinct pattern you will remember under stress. Keep it simple: you will use it once, in a bad moment.
Decide what happens to the other vaults’ iCloud backups. At setup, HushKeep asks whether to also erase the iCloud backups of the other vaults. It is off by default:
- Leave it off (default): the other vaults’ keys are destroyed on this device, but their encrypted backups stay in your iCloud, and they can still be restored from iCloud with their recovery phrases. This is the right choice in most cases.
- Turn it on: the other vaults’ iCloud backups are erased as well, so after the duress event they exist nowhere — on this device or in iCloud — until you re-import them from your original copies. Choose this only if you understand and accept that consequence.

If you later let Pro lapse, an emergency pattern that was already set keeps working — it can be tested and turned off, just not changed.

What the duress event looks like, step by step

Someone is looking, and you are going to unlock the phone.
Draw the emergency pattern, not your real one.
The decoy vault opens. It shows your prepared, believable content.
On this device, the keys to your other vaults are now destroyed. Their contents cannot be opened here, by anyone.
Once you are safe: the other vaults can be restored from their iCloud backups using their recovery phrases (if you left backup erasure off), and you can set a new emergency pattern in the restored vaults.

Know the limits

HushKeep’s security page states its threat model openly, and this scenario has hard edges:

It protects the vaults on this device. It does not protect copies of the phone made beforehand, or your iCloud if the backup-erasure option was left on and backups still existed elsewhere.
Physical coercion beyond the duress unlock is out of scope. If someone has your phone and your unlocked pattern in front of them, the emergency pattern is what remains — nothing more.
The recovery phrases of the destroyed vaults are your way back. If you left backup erasure on and you have no recovery phrase, those vaults’ contents are gone by design: your vaults can only be decrypted with your pattern or recovery phrase, and we hold neither.
The decoy vault stays on the device. After a duress event, it is a normal vault with its own pattern and phrase.

Checklist

Decoy vault created and filled with believable content.
Emergency pattern set in the vault it protects.
Backup-erasure choice made deliberately (default: off).
Recovery phrases of the protected vaults written down and stored somewhere the phone does not have to be.
You have run the duress flow once, on a spare set of vaults, so the sequence is familiar.

This is general information, not legal or security advice for a specific situation.