Which Bitcoin hardware wallets have a duress PIN?

People use these words for different features, and the difference decides what an attacker sees.

Ordered by my current rating (each review has the score). Prices are the vendor's list price as of November 2026.

SeedSigner has no PIN, so nobody can make you type one. Its README says it keeps seeds in memory only while powered, and all memory is wiped when power is removed. Unplugged, it holds nothing. It also supports a BIP39 passphrase, so one seed can open a small front wallet and a separate passphrase wallet.

The catch: the coercion risk moves to your seed backup, which for most SeedSigner owners is a SeedQR card. Anyone who finds that card can load it into any device. Keep it somewhere other than where you live, or the stateless design protects you on paper only.

During an unlocked session, go to Options > Authentication > Duress PIN and set a PIN different from your normal one. If anyone enters it at unlock, Blockstream says Jade deletes the encrypted wallet information and displays "Internal Error", so it looks like the device failed. Nothing happens to your bitcoin on the blockchain. You get the wallet back by restoring your seed phrase, plus your passphrase if you use one.

What it does not do is open a decoy wallet. A user asked for exactly that in Jade issue #326 in August 2026, and a Blockstream contributor replied that the blocker is firmware support for two encrypted seeds on one device. The issue is still open.

The two features combine well. Jade never stores your passphrase, so you can keep a small balance in the plain wallet, keep savings behind a passphrase, and still have the duress PIN if someone wants the device itself unlocked. Jade and Blockstream's PIN oracle also delete their keys after three wrong PINs.

Krux has no device PIN. It stores nothing unless you choose to save an encrypted mnemonic to its flash or an SD card, and its own docs say that storage is for convenience only and not a long-term backup. You can type or scan a BIP39 passphrase when you load a wallet. I found no duress feature in its docs.

For coercion, Krux behaves like SeedSigner: an unplugged device holds nothing, so the question becomes where your backup lives. If you saved an encrypted mnemonic to the device, its strength is the strength of the key you chose.

The original Jade runs the same firmware as the Jade Plus. Blockstream added the wallet-erase duress PIN in firmware 0.1.35 in August 2022, so any Jade on current firmware has it. The store lists it at $67 on sale against a $79 list price.

Specter DIY has no duress PIN. Its security model recommends temporary seed mode, where the recovery phrase lives only in RAM and is gone at power-off. The device wipes its internal flash on the 10th wrong PIN attempt.

Its docs are unusually direct about passphrases: a passphrase wallet has its own fingerprint and addresses, the passphrase is never stored on the device or the smartcard, and there is no way to prove a passphrase wallet does or does not exist. That makes the passphrase Specter DIY's decoy feature.

Jade Core runs Jade firmware without a camera. In the firmware source, the Duress PIN entry sits outside the camera-only code, next to OTP in the authentication menu, so the Core gets the same wipe behavior as the Plus. It costs $99.

Foundation's settings documentation lists no duress or decoy PIN. Passport Prime erases the master key after 10 consecutive wrong PIN attempts, and optional Security Words show two words partway through PIN entry so you can tell if someone swapped your device.

Foundation's wallet docs pitch the passphrase for plausible deniability in the event of a physical attack, say the passphrase is never saved to the device, and say Envoy shows passphrase accounts only while the passphrase is active on the Prime. That last part matters: a paired phone that always showed the hidden accounts would give the decoy away.

BitBox02 has no duress PIN. BitBox's support page says the optional passphrase creates additional hidden wallets and enables plausible deniability, is never stored on the BitBox, and is not included in your backups. The firmware resets the keystore after 10 failed unlock attempts.

Keystone's Bitcoin-only page lists a passphrase and a self-destruct that destroys the keys if someone physically tampers with the device. It lists no duress PIN. A tamper switch defends against a lab attack on a stolen device; it does nothing when someone is standing next to you asking for the PIN.

Two cautions. The device ships with multi-coin firmware, and Keystone says to update it after you receive it to get the Bitcoin-only features. And in October 2026 an attacker took the key Keystone uses to prove a device is genuine, so Keystone paused shipments and is destroying 18,835 unsold devices. Keystone's store lists the 3 Pro as a pre-order.

Trezor sells Bitcoin-only editions of the Safe 3, 5, and 7, with firmware that supports only BTC accounts. The wipe code is a second PIN, and entering it means your Trezor immediately erases all private data, including your wallet, and resets to factory defaults. When it finishes, the screen says the wipe code was entered and the device was erased.

That screen is honest, and it also tells the person watching exactly what you did. Jade's "Internal Error" at least looks like a fault. For a decoy, Trezor's passphrase opens a completely new wallet, and the device doesn't store the passphrase.

OneKey documents no duress PIN. Its help center describes Attach to PIN: from Classic 1S firmware 3.14.0, you can bind a second PIN to a passphrase wallet, so that PIN opens the hidden wallet directly. That is the only PIN-to-decoy feature on this page.

The catch: OneKey's passphrase article says the Classic 1S and Classic 1S Pure support it, and neither article says whether the Bitcoin-only firmware does. Check for the Bind PIN menu on your own device before you rely on it. The firmware also descends from Trezor's code, and the parent company sells multi-coin devices.

A duress PIN you have never tried is a guess. Bitcoin Well's guide recommends testing on a reset, unfunded Jade Plus first, never on the only device that controls real money.

This works on every device in the table. The full walkthrough, including how strong the passphrase should be, is in my passphrase guide.

A decoy asks you to fool someone under pressure. A 2-of-3 multisig asks nothing of you in that moment. If one key lives in your house and the other two live somewhere else, nobody in your house can spend, including you, so there is nothing to force out of you on the spot.

Pick three devices from different companies, keep one at home, and put the other two at a relative's house, an office safe, or a safe deposit box. My multisig hardware wallet picks cover which devices pair well and why.

Coldcard is the device people expect on this page, because Coinkite built a whole menu of trick PINs. I delisted it. A flaw in how Coldcard generated seed phrases shipped in firmware from March 2021 to July 2026, and Galaxy Research confirmed at least 1,778 BTC drained. A trick PIN cannot protect a seed that was weak from the day it was made. The sources, and a free checker for existing owners, are on why I delisted Coldcard.

These devices come up for "duress PIN" searches. Their features are real, but they run firmware with code for other coins, so I don't recommend them.

If you want a panic button on the device itself, get the Jade Plus: duress PIN, passphrase, and QR signing for $149. The Jade has the same firmware for less, and Jade vs Jade Plus covers the difference.

If you would rather have nothing on the device to unlock, use SeedSigner or Krux with a passphrase, and keep the seed backup out of your home. Krux vs SeedSigner helps you choose.

If you already own a BitBox02 Bitcoin-only or Passport Prime, set up a passphrase decoy; both vendors document it for exactly this. For savings large enough to make you a target, put any of these into a 2-of-3 with keys outside the house.