Phone searches at the border: what a Vault can and cannot do
Rules for searching phones at a border differ by country, change over time, and are not something an app can settle. Start with a rights organisation's current guide for the country you are entering. A Vault can reduce what is on your phone and what a casual look finds, but it promises nothing about what officials may demand or how they may react. This page is not legal advice.
Read the rules for where you are going
Which searches are allowed, whether officials may ask for a passcode, and what happens if you decline all depend on the country, your citizenship or immigration status, and sometimes the officer. They also change. Two places to start:
- The Electronic Frontier Foundation's whitepaper "Digital Privacy at the U.S. Border: Protecting the Data On Your Devices" covers risk factors, precautions before and during travel, and the legal rights that apply. It is dated March 2017, and the page itself notes that parts may no longer reflect current law or practice, so use it for the questions to ask and then look for current guidance.
- The Committee to Protect Journalists' Digital Safety Kit has a "Crossing borders" section. It suggests steps before travel, such as backing up devices, logging out of accounts and considering clean travel devices, and advises powering off devices and keeping them in sight. It warns that if a device is confiscated or anything is inserted into it, you should assume it is compromised.
Your national civil-liberties or digital-rights organisation, and a lawyer who knows border law, can tell you more than this page can. If you are not a citizen of the country you are entering, ask before you travel, because the stakes and the rules can differ.
The most reliable option: carry less
The most dependable way to reduce what a search can reach is to have less on the phone. That can mean a separate travel phone, signing out of accounts, and leaving private files at home or in a place you can restore from. StrongRoom helps with the last part: a Vault can be exported as an encrypted file and restored later, so you can delete it from the phone before travel and restore it after.
- Make an Export Package of each Vault. Keep the file somewhere you control that is not the phone you carry.
- Keep the Recovery Phrase on paper, not on the phone.
- Delete items or Vaults from the phone, if that fits your plans.
- After travel, restore on a fresh install with no Vault, from the Export Package with the Recovery Phrase.
Be careful with this step. Anything you have exported and stored online or on another device is now subject to the rules for that device and service. The Export Package is encrypted and unreadable without the phrase, but you are the one who decides where it lives.
What each StrongRoom option does and does not do
| Option | What it does | What it does not do |
|---|---|---|
| A Vault with your pattern or passphrase | Keeps items encrypted when the phone is locked and the Vault is closed; guessing is slowed | Does not stop an officer from demanding that you open it, and does not decide what the law lets them do |
| Empty Vault (free) | A credential that opens nothing shows an empty Vault, so the screen never says "wrong" | Is not a promise that anyone will accept an empty Vault as the whole story |
| Decoy Vault (Pro) | An ordinary extra Vault you fill with harmless items and open when pressed | Does not make a false account lawful or believed; some places treat a lie to officials as an offence |
| Duress Vault (Pro) | Opening it erases every other Vault on the phone, with nothing on screen to say so | Cannot be undone without an Export Package, and in some places destroying data during a search may itself be an offence |
Think carefully before using a Duress Vault
A Duress Vault erases every other Vault on the phone, silently and for good. That may be exactly what you want in some situations. In others it can create legal trouble of its own, because deleting data when asked to unlock a device can be treated as obstruction or destruction of evidence. We cannot tell you whether it is lawful where you travel, and we do not promise that a wipe, an Empty Vault or a Decoy Vault will satisfy anyone. If you consider it at all, read what the Duress Vault is and decide in advance, with advice, not at the counter. Is a Duress Vault legal to use?
Face ID and other biometrics
StrongRoom does not offer Face ID or Touch ID, on purpose: it would show which Vault is real. Your iPhone itself does use them for unlocking, and the CPJ kit mentions considering whether to turn off biometric unlocking when travelling. Whether biometrics and passcodes are treated differently by officials depends on the country; ask a rights organisation.
Where StrongRoom does not help
- It does not hide itself. The app is visible on the Home Screen, and a person looking can see that you have it.
- It does not protect a phone that has been seized and compromised, or one with spyware on it. Assume a confiscated device is compromised, as CPJ advises.
- It does not control what happens if you decline to unlock a device. That is a legal matter, not a technical one.
- It does not remove location data or other metadata from photos.
- It keeps no copy off the phone. A Duress wipe, a seizure or a loss is final without an Export Package and the Recovery Phrase.
A cautious checklist
- Read a current guide from a rights organisation for your destination.
- Decide what must be on the phone and move the rest off.
- Make an Export Package and store it where you can reach it later.
- Write the Recovery Phrase on paper and keep it apart from the phone.
- Choose a passphrase rather than a pattern for the Vault if the risk is serious.
- Decide in advance, with advice, what you will do if asked to unlock your phone. Do not improvise at the counter.
Frequently asked questions
Can border agents search my phone?
It depends on the country and the circumstances, and the rules change. Read a current guide from a rights organisation, such as EFF's border guide, and consider legal advice before you travel.
Does a Decoy Vault protect me from a border search?
It shows harmless items when opened, but it makes no promise about what officials may demand or believe. Some places treat false statements to officials as an offence.
Will a Duress Vault keep me out of trouble?
No promise is possible. A Duress Vault erases other Vaults for good and may itself be an offence in some places.
Can I take my Vault with me without keeping it on the phone?
You can make an Export Package, delete the Vault from the phone and restore it later with your Recovery Phrase.
Sources
- Digital Privacy at the U.S. Border: Protecting the Data On Your Devices (Electronic Frontier Foundation), checked on 2026-10-30.
- Digital Safety Kit (Committee to Protect Journalists), checked on 2026-10-30.