Most phones have no duress PIN, so we built emergency erase into Morse Messenger

Originally published on joinmorse.com, where the diagrams are animated.

Short answer: only GrapheneOS has a built-in duress PIN. iPhones, Samsung phones and Pixels with Google's own software don't. Morse Messenger can't protect the rest of your phone, but it does protect your Morse chats: turn on emergency erase, and two taps erase everything in Morse, even from its lock screen without unlocking it. Your one-to-one chats disappear from your contacts' phones too. A real duress PIN for Morse is coming.

Here's what a duress PIN is, why your phone probably doesn't have one, and how we built emergency erase: what it erases, what happens on your contacts' phones, and where its limits are.

What is a duress PIN?

A duress PIN is a second unlock code. You set it up next to your normal one. If someone ever pressures you into unlocking your phone, you type the duress PIN instead, and the phone erases itself instead of opening.

The idea behind it is simple. End-to-end encryption protects your messages on their way, and a locked phone protects them while they sit on it. Neither helps once someone makes you unlock it. At that moment, erasing is the only protection left.

And it's not only about you. Your chats hold other people's words too: the friend who told you something in confidence, your family, the people you work with. Erasing protects them as well.

A few moments when it matters:

• Someone grabs your phone while it's open, or makes you open it.
• A partner who checks your phone. For someone in a controlling relationship, a chat with a friend or a helper can be dangerous to have on it.
• Journalists, activists and anyone people trust with something sensitive. If you work with sources, our guide to messaging for journalists covers the rest.

Does your phone have a duress PIN?

Almost certainly not. GrapheneOS, an alternative Android system for Pixel phones, added one in 2024. Typed anywhere the phone asks for its PIN, it will "irreversibly wipe the device", in GrapheneOS's own words.

iPhones, Samsung phones and Pixels with Google's own software have nothing like it. The closest thing on an iPhone is a setting that erases it after 10 failed passcode attempts, which doesn't help when someone makes you type the right one. And erasing a whole phone takes everything with it: your photos, your other apps, all of it.

Messaging apps mostly don't fill the gap either. Most only let you delete your account or clear your chats from inside the app, and the people you talked to usually keep their copy.

Emergency erase in Morse Messenger

So we built it into Morse. Emergency erase is off by default, because a button that erases everything shouldn't be one you can hit by accident. To turn it on:

1. Open the You tab, then Privacy & Security.
2. Tap Panic button. It gets its new name, Emergency erase, in our next update.
3. Turn on Show panic button. If you like, also turn on Also erase saved photos & videos.

From then on, an erase button shows in the app and on Morse's lock screen. Two taps erase everything: the button, then Erase Everything. You don't need to unlock Morse first.

Morse is available for iPhone. Emergency erase is in the Android app too, which is coming soon.

What happens after the two taps

In a few seconds:

1. Morse asks our server to delete your account, while your phone still has a connection.
2. It destroys the key that opens Morse's database. Every message and every contact in it becomes unreadable at once.
3. It deletes the database files and everything the key doesn't cover: photos and videos you opened, voice and camera recordings, temporary files, notifications on your screen, the app's badge, and your clipboard if it still holds something you copied in Morse.
4. It checks that nothing is left, and goes again over anything that survived.
5. Your contacts' phones remove your one-to-one chat with them, and you from their contacts.

Then Morse is back at its welcome screen, as if it was just installed. There's nothing to bring back either: the keys that open Morse's data are stored for your phone only, so even a backup of it can't be read on another device.

How it works, for the technically curious

Why destroy a key instead of deleting files? On a phone's flash storage, deleting a file doesn't reliably remove it. The chip spreads its writes around to wear evenly, so old data can linger in places an app can't reach. So Morse doesn't rely on deleting. Its database is encrypted on your phone with a key kept in the phone's protected key storage. Destroy that key, and whatever is left on the chip is noise. That's called a crypto-erase, and it takes no longer with ten thousand messages than with ten.

But isn't that key just more data on the same chip? Fair question, and the PIN lock is the answer. With Morse's PIN lock on, the database key is itself locked twice: under your PIN, and under a key held by the Secure Enclave on iPhone or the Android Keystore on Android, which can never be copied out of the phone. The erase deletes that hardware key too. So even if a locked copy of the database key lingers somewhere on the chip, nothing exists anymore that could open it.

Why can it run on the lock screen? Because you don't need a key to destroy it. Erasing never opens the database, so Morse can do it without your PIN. The one thing the erase needs while Morse is locked is permission to delete your account on our server. Morse keeps a deletion token for that, readable while locked. It's only good for deleting the account: it can't read or send anything.

Why the server comes first: your contacts' phones only learn you're gone from our server. So Morse asks the server first, while your phone is still connected, and waits only briefly. A slow network never holds up the erase on your phone: if no answer comes, your phone is erased anyway.

Before any of that, Morse stops everything it runs in the background, so nothing writes new data in the middle of the erase. Then the account goes, then the key, then the files, then the check.

Saved photos were the tricky part. An iPhone can't list "the photos this app saved", so Morse keeps its own list as it saves each one and uses that list to delete them. iOS asks you to confirm deleting photos, which is Apple's rule, so Morse erases your chats first and that question can't hold anything up. On Android 10 and newer, Morse deletes the photos and videos it saved in its own folders.

If you want the full picture of how Morse stores and protects your data, it's in our security white paper.

The details that took the most work

An erase sounds simple: delete everything. Most of the work went into the places where "everything" hides, and the things that can get in the way:

• A message can arrive in the middle of an erase. On iPhone, notifications are handled by a small separate process that can wake up at any moment, and a message it saved while the database was being destroyed could survive. So before anything is deleted, the erase tells that process to stop writing.
• Some of the cleanup goes through the phone's own services: clearing the app's badge, the notifications on your screen, the suggestions your phone learned from your chats. Those can be slow to answer. None of them gets to hold up the erase: each gets a short time limit, and the erase moves on.
• A file isn't gone while something still points to it. To play videos, the app makes extra links to decrypted files, so deleting the media folder alone would have left those videos on the phone. The erase empties the whole temporary folder instead, whatever is in it.
• Erasing the photos Morse saved needs full access to your photo library on iPhone, which Morse otherwise never asks for. That's why it's a separate switch: you only give that access if you want those photos erased too.

How we make sure nothing is forgotten

An erase is only as good as its list. A messenger keeps things in more places than you'd think: the database, the phone's key storage, settings, caches, temporary files, the parts of the app that run in the background. Every one of them is on a single list, on both iPhone and Android, with tests.

That list can only fall behind when the app grows, so we made it hard to forget: a rule in our codebase says no new place to store data ships without being added to the erase, with a test, in the same change.

And the erase never assumes it worked. When it's done, it checks every item on the list and goes again over anything still there.

What happens on our server

On our side, the erase deletes your account and everything tied to it: your keys, any messages still waiting to be delivered to you, your push registration, your encrypted profile and photo, your pending contact requests and your profiles in groups. Then the server tells your contacts' phones that you're gone.

Your App Store subscription record stays, marked as used and no longer tied to your Morse ID, so it can't be moved to a new account. Your messages were never readable on our server to begin with: it only ever passes encrypted messages along.

What it protects against, and what it doesn't

Better to know the limits now than to find them out at the worst moment:

There's no undo. The account is gone, and you'll need a new one.

Next: a duress PIN for Morse

Emergency erase covers the moment before. A duress PIN covers the moment itself: a second PIN for Morse's lock screen that you can type when someone makes you open the app, and that erases everything instead of opening it. It's coming in a future update.

Until then, two things keep what's at stake small. Turn on disappearing messages for the chats that matter, so there's less on your phone to begin with. And Morse has no linked devices, so nobody can read your messages from another phone by quietly adding one while they hold yours.

The short version

Most phones can't erase themselves when you're forced to unlock them, and most messengers can't erase your chats in a hurry. Morse Messenger can: two taps, from the app or its lock screen, and your one-to-one chats disappear from your contacts' phones too.

Turn it on before you need it: in the You tab, under Privacy & Security, Panic button. And if you're curious how else we build Morse, we wrote about building a messenger without phone numbers.

Questions people ask

Does iPhone have a duress PIN?

No. iOS has no duress passcode. The closest setting erases the iPhone after 10 failed passcode attempts, which doesn't help when someone makes you enter the right one. In Morse Messenger, emergency erase lets you erase your Morse chats in two taps, even from its lock screen.

Does Android have a duress PIN?

Not built in. Samsung phones and Pixels with Google's own software have no duress PIN. GrapheneOS, an alternative Android system for Pixel phones, has had one since 2024.

What happens to my messages on the other person's phone?

When you use emergency erase in Morse, your one-to-one chats disappear from your contacts' phones as soon as our server has deleted your account. Messages you sent in group chats stay in those groups.

Can messages be recovered after an emergency erase?

No. The erase destroys the key that opened Morse's database, so what's left on the phone can't be read, and Morse's keys are never in a backup that another device can open. With the PIN lock on, even the hardware key that locked the database key is deleted.

Can I erase my messages remotely?

Not in Morse: emergency erase works on the phone itself, from the app or its lock screen. Morse has no linked devices and no web version, so your chats don't live anywhere else.

Sources

1. Duress PIN/Password: GrapheneOS, features overview.
2. GrapheneOS release 2024053100: GrapheneOS, May 2024: the release that added the duress PIN.
3. Set a passcode on iPhone: Apple, iPhone User Guide.