Test a Jade Plus duress PIN safely

A Jade Plus duress PIN is an alternate PIN that deletes encrypted wallet information stored on Jade when entered. It does not move, erase, or destroy bitcoin on the network. The wallet can still be recovered using its recovery phrase and any required BIP39 passphrase.

Use a reset, unfunded Jade Plus first. An accidental trigger can lock you out of that Jade. Finish and test the recovery backup before evaluating this feature.

Understand what the duress PIN does

The feature is useful only when the recovery backup is complete, accurate, separated, and accessible. It is not a substitute for physical security and is not, by itself, a complete plan for coercion.

The duress PIN does not open a decoy wallet or move funds. Blockstream describes providing or storing the alternate PIN as a decoy tactic because entering it deletes the encrypted wallet information and displays Internal Error. That behaviour is not, by itself, a complete coercion plan. Anyone with the recovery phrase and any required passphrase can still restore the wallet.

Decide whether the benefit justifies the lockout risk

Enable the feature only if you can restore the intended wallet from an independently tested backup. Record the expected wallet fingerprint and one address verified on Jade before configuration. Do not rely on memory for a BIP39 passphrase.

If another person may need to recover the wallet, document that the feature exists and what a triggered device will look like. Do not put either PIN in the same instructions as the recovery phrase. A duress PIN does not create a decoy balance, summon help, or prevent someone from finding a separate backup.

Official reference: Enable a duress PIN.

Test the feature before enabling it

Use a reset, unfunded Jade with a fully recorded test recovery phrase:

1. Confirm ordinary PIN access and the expected wallet fingerprint.
2. Configure the duress PIN using Blockstream's current device-side flow.
3. Power-cycle Jade and confirm the ordinary PIN still opens the intended wallet.
4. Trigger the duress PIN on the reset, unfunded Jade Plus.
5. Verify the documented deletion behaviour.
6. Recover the wallet directly on trusted hardware using the recovery phrase and any BIP39 passphrase.
7. Confirm the expected fingerprint and one known hardware-verified address.
8. Complete a small signing test with the unfunded or small-value test wallet.

Do not perform this experiment on the only device controlling meaningful funds. Keep the ordinary PIN and duress PIN distinct. Document the feature's existence in private operational instructions without placing either PIN beside the recovery phrase.

Recover after a trigger

Treat a triggered Jade as a device that no longer retains the wallet. Follow Blockstream's current recovery flow and enter the recovery phrase and any passphrase directly on trusted hardware, never in the companion app. Confirm the expected fingerprint and complete known address before signing. Use a small test when enough signing material to authorize a spend is not confirmed exposed. If only one factor may be exposed, treat it as untrusted and assess what else an attacker would need. If enough signing material to authorize a spend is confirmed exposed, move urgently to a fresh hardware-verified wallet without delaying solely for a test when delay materially increases theft risk.

If the duress PIN activates unexpectedly, investigate who had physical access and whether the backup may also have been exposed. Recovering the same wallet does not rotate its keys.

Before enabling a duress PIN, complete Secure Jade Plus before funding and Test a Bitcoin wallet recovery. If the backup cannot pass recovery, do not enable the feature. For stateless signing, read Use Jade Plus Temporary Signer safely.

Software visual reference

Updated on: 04/08/2026