GrapheneOS Duress PIN: How the Phone-Wipe Feature Actually Works

Photo by Daniel Romero on Unsplash

Most coverage of the GrapheneOS duress PIN frames it as a self-destruct button, the kind of thing spies use in films. That framing is wrong in ways that matter for anyone about to cross a US border with a Pixel in their pocket. The feature is not a bomb. It is a second credential that, when typed anywhere the operating system asks for a passcode, replaces the unlock flow with an irreversible wipe of the device and its eSIMs.

On July 26, 2026, TechSpot reported that federal prosecutors charged Atlanta resident Sam Tunick after his GrapheneOS phone wiped itself during a January 24, 2025 secondary inspection at Hartsfield-Jackson Atlanta International Airport. He had just flown in from the Dominican Republic. Whatever the outcome, the case is the first serious legal test of a security feature that has quietly shipped on Pixel phones for years.

The Misconception That Keeps Getting Repeated

Headlines describe the feature as a phone that wipes when police enter the wrong PIN. It does not work that way. Wrong PINs trigger throttling, not erasure. GrapheneOS documents that the fifth failed unlock attempt produces a 1-minute timeout, attempt 10 forces a 4-hour timeout, attempt 15 forces 41 days, attempt 19 stretches to roughly 9 years, and attempt 20 blocks all further tries. The secure element enforces these delays in hardware, so a phone left with a border officer does not obediently accept unlimited guesses.

The duress credential is a separate, deliberate secret. You choose it. You type it yourself. Nothing else fires the wipe.

GrapheneOS's official feature page states that entering the duress PIN or password at any device credential prompt, including the lock screen and OS authentication dialogs, irreversibly erases the device along with any installed eSIMs. The wipe does not require a reboot and cannot be interrupted once it starts. There is no confirmation dialog, no countdown, no undo. SaferPhone's July 20, 2026 guide describes the aftermath plainly: the phone shows the normal initial-setup screen, as if it just came out of the box.

The Setup Path Nobody Screenshots

Enabling the feature lives four taps deep. GrapheneOS documentation places it under Settings > Security & privacy > Device unlock > Duress Password, inside the owner profile. The naming is a source of confusion. GrapheneOS requires you to configure both a Duress PIN and a Duress Password before the feature turns on. The PIN handles PIN-entry prompts. The password handles password-entry prompts. Different user profiles on the same device can use different unlock methods, which is why the project treats them as separate mandatory secrets rather than one setting.

The duress PIN also wipes the device when entered as the two-factor fingerprint unlock PIN. It does not wipe when entered as the SIM PIN, a limitation GrapheneOS spells out in the same documentation.

One rule buried in the docs quietly defeats the whole feature if you get it wrong: if your duress PIN or password is identical to your real unlock credential, the real credential wins and no wipe occurs. This sounds obvious until you consider that the safest-feeling duress PIN, structurally, is one close to your real PIN. It is also the most dangerous, because collisions silently disable the protection.

The Analogy That Actually Helps

Think of a bank branch with two keypad codes at the vault. One code opens the vault. The other opens the vault and simultaneously triggers a silent alarm that pours concrete into the safe deposit boxes. From the outside, both codes look like normal keypad entries. The teller cannot tell which you used. Neither can a security camera. The only observable difference is what happens ten seconds later, and by then the intervention is irreversible.

That is the correct mental model for how the GrapheneOS duress password works. It is not authentication that fails loudly. It is authentication that succeeds into a destructive branch of the code path.

The Atlanta Case Nobody Predicted

According to the defense motion filed in United States v. Tunick in the Northern District of Georgia (case 1:25-CR-499), CBP officers placed Tunick in secondary inspection on January 24, 2025, searched his body and belongings, and insisted he provide his phone passcode. The one-count indictment alleges he destroyed the "digital contents" of his cellular phone to prevent CBP's Tactical Terrorism Response Team from searching and seizing them. The charging statute is 18 U.S.C. 2232(a), which criminalizes knowingly destroying, damaging, or disposing of property to prevent lawful government seizure.

The filing states that officers were investigating Tunick because of his association with Defend the Atlanta Forest, the movement opposing the 85-acre, $115 million Atlanta Public Safety Training Center. The same filing notes that the government had not put forth evidence connecting Tunick to any criminal activity within that movement.

What happened at the keypad, per the government's own account quoted in the filing: after a password was entered, "the screen went blank, flashed several times and the phone appeared to restart." TechSpot's July 26 report adds that agents repeatedly asked Tunick to unlock the phone and warned they would seize it if he refused. A judge is not expected to rule on the defense's suppression motion until at least late October 2026.

The Guardian reported on July 23, 2026 that the case may be the first known attempt to aim 18 U.S.C. 2232(a) at an operating system feature rather than a conventional physical act of destruction. That distinction is the entire legal fight. Tearing up a document is destruction of property. Typing a legitimate credential into a device that then runs its own erase routine, without any hardware damage, is a category the statute was not written for.

The defense argues, per the motion, that Tunick asked four times to speak with a lawyer, that agents produced no warrant, and that agents did not read him his rights. The filing also argues that compelling a passcode is testimonial and triggers Fifth Amendment protection. Christophe Boutry, a cybersecurity and surveillance expert quoted by The Guardian, called the prosecution "concerning" and warned it sends the message that GrapheneOS is treated as criminal by default. Marlon Kautz of the Atlanta Solidarity Fund told the paper, "We all have a right to secure our private data against unconstitutional searches."

What The Feature Cannot Save You From

A duress PIN is a lock-screen defense. It does nothing if the phone is already unlocked when it is taken from your hand, which is the standard tactic at customs desks: officers hand you the device with the screen on and ask you to open a specific app. It also does nothing about data that already exists elsewhere. SaferPhone notes that cloud backups, prior device syncs, and messages held by other participants in a conversation remain untouched by any local wipe.

The largest practical failure mode is not legal. It is accidental entry. SaferPhone recommends structuring the duress PIN to be a different length from the real PIN, because a duress code that looks similar to your real one is the code you will eventually mistype in a hurry. The wipe is silent, immediate, and irreversible. There is no "are you sure."

Companion protections matter more than most guides acknowledge. GrapheneOS enables auto-reboot by default at 18 hours of inactivity, adjustable from 10 minutes to 72 hours, which returns the device to the Before First Unlock state where encryption keys are not in memory. Lockdown mode disables biometric unlock and notifications on the lock screen with a single action. Together, these features close the gap the duress PIN alone cannot: what happens when you never get the chance to type anything at all. For readers building a broader threat model, our Privacy & Security articles cover related territory.

The Spec That Predicts Real-World Security Better Than the Wipe Itself

The duress PIN gets the headlines, but the feature that actually makes GrapheneOS phones expensive to attack is the hardware-bound key derivation. GrapheneOS explains that key derivation is anchored to the SoC and a hard-wired hardware key inaccessible to software or firmware. Without extracting that hardware key, brute-force attempts cannot be offloaded to more powerful machines. Every guess has to happen on the phone itself, at the phone's speed, subject to the throttling schedule.

That is why a four-digit PIN on a Pixel running GrapheneOS is not the same as a four-digit PIN on a laptop drive. The 20-attempt hard ceiling combined with the 41-day and 9-year timeouts turns any short PIN into a credential that resists offline attack in a way password-hash dumps do not. The wipe feature sits on top of that foundation. Without the underlying secure element behavior, a duress PIN would be theatre.

One detail worth flagging for anyone testing setup: GrapheneOS documents that PIN or password entries below the minimum length of 4 characters are rejected without counting as failed attempts, and that the most recent 5 unique failed attempts above the minimum length are cached in memory and cleared on unlock or reboot. Repeatedly typing the same wrong PIN does not burn through the attempt counter. Distinct wrong PINs do.

What Changes About Border Crossings

The Tunick case does not settle the question of whether entering a duress PIN at a CBP checkpoint is a crime. It does confirm that federal prosecutors are willing to try the theory. The Guardian's coverage notes the underlying dispute is not just whether the phone wiped, but which constitutional protections apply at US borders and international airports, where the government has historically claimed broad search authority. For travelers thinking about GrapheneOS border search privacy, that ambiguity is the real news.

The practical implication is narrow and specific. If you configure a duress PIN on a device you carry across a US border, understand that the wipe itself may become the evidence against you, even in the absence of any evidence that the wiped data was incriminating. That is a novel legal exposure the GrapheneOS project's threat model does not resolve. The safer posture is to travel with a device that has nothing on it worth wiping in the first place: a separate profile, a freshly set up phone, or no phone at all. A duress PIN Android configuration is a last resort, not a substitute for not carrying the data.

Set the feature up carefully. Choose a duress credential structurally different from your real one. Enable auto-reboot at a short interval. Understand that the moment you type the duress code, you are choosing between whatever is on the device and whatever comes next in a courtroom.