Your Keycard can have a second PIN that opens a decoy wallet

This feature exists, and most owners don't know about it.

What it is?

When you set up a Keycard you create a six-digit PIN. Optionally, you can also set a duress PIN which unlocks a decoy wallet.

The decoy behaves exactly like a normal wallet. It has its own addresses, you can send and receive with it, and there is no visible way to tell whether you're in the decoy or the real wallet or whether a decoy exists at all. Only you know.

The idea is straightforward: if someone forces you to unlock your card, you give them the duress PIN and they see a normal, working, low-value wallet

The part that matters most:

⚠️ You can only set a duress PIN during initial setup

If you skip it, the only way to get one is to factory reset the card and set it up again from your recovery phrase.

This isn't an oversight. If a duress PIN could be added afterwards, an attacker could check whether one exists - which would defeat the entire point. The feature only works if its existence is undetectable, and that means it has to be decided at setup

Details worth knowing:

> The decoy uses the same recovery phrase and standard derivation paths. It just produces a different set of addresses

> You have to fund it yourself.  An empty decoy isn't convincing. Move a plausible amount into it.

> Recovering onto a new Keycard restores both wallets together.

> Your two PINs are independent - changing one doesn't affect the other.

> The Shell won't let you set both PINs to the same value.

> Three wrong attempts on either PIN blocks the card. You unblock with your PUK; without a PUK you factory reset and restore from your recovery phrase.

Your funds are never at risk from this - the recovery phrase is what protects them, not the PIN.

Docs: here