Must You Disclose Your Phone’s Unlock Code to Investigators?

As a general rule, no one is required to enter their own phone code, and the right to remain silent stays fully intact. Refusing to disclose it to investigators (services d’enquête) who lawfully request it may nonetheless constitute an offence, punishable by three years’ imprisonment and a €270,000 fine. The European Court of Human Rights (ECtHR) has just confirmed this in its Minteh v. France decision of 19 May 2026. Even so, a conviction is never automatic: it requires a set of strict conditions to be satisfied, the examination of which offers the person under investigation a corresponding number of lines of defence.

The offence: refusing to hand over a decryption convention (convention de déchiffrement)

Article 434-15-2 of the French Penal Code, found among the offences of obstructing the course of justice, penalises the refusal, by anyone aware of the secret decryption convention for a means of cryptology (moyen de cryptologie) that may have been used to prepare, facilitate or commit a serious crime or other offence, to hand it over to the judicial authorities or to implement it when duly requisitioned to do so. The penalty, three years’ imprisonment and a €270,000 fine, is increased to five years and €450,000 where handing over the code would have made it possible to prevent an offence or limit its effects.

Two features of this offence should be highlighted from the outset. It is freestanding: it may be combined, where applicable, with the main proceedings, most often in drug-related matters, and a conviction is entered on the individual’s criminal record, even where investigators ultimately manage to access the device by other means. It is also preventive: it is enough that the means of cryptology may have been used in connection with an offence, without any need to prove that it actually was.

A conviction that is never automatic

The apparent severity of the provision does not exempt it from judicial scrutiny. The offence is only made out where several cumulative conditions are satisfied, and the Criminal Division of the Cour de cassation (French Court of Cassation) has, on several occasions, quashed convictions handed down where the trial courts had failed to establish them. Each of these conditions represents a potential line of defence, to be examined methodically in light of the case file.

The five points of vigilance for the defence

1. A duly issued requisition (réquisition), accompanied by the mandatory warning

This is, in practice, the most decisive ground of defence. The Cour de cassation consistently holds that “a simple request made in the course of an interview, without a warning that refusal to comply may constitute a criminal offence, does not amount to a requisition” within the meaning of the provision (Cass. crim., 13 October 2020, no. 20-80.150; Cass. crim., 12 October 2022, no. 21-81.648). The request must, moreover, come from a judicial authority, or from a judicial police officer acting under its supervision pursuant to Articles 60-1, 77-1-1 or 99-3 of the French Code of Criminal Procedure. Examining the record of proceedings is therefore the first reflex: absent a duly issued requisition and an express warning of the criminal risk, no conviction can be handed down.

2. Proof, provided by the prosecution, of a genuinely encrypted phone

An unlock code (code de déverrouillage) is not, in itself, a secret decryption convention. The Plenary Assembly of the Cour de cassation has made this clear: the code can only constitute such a convention if the phone is equipped with a means of cryptology and if activating it has the effect of rendering encrypted data intelligible. Locking a screen is not the same as encrypting it: an older device, or one whose encryption has been disabled, falls outside the scope of the offence. This verification is for the court to carry out, if necessary by means of a further investigative measure (Cass. crim., 6 March 2024, no. 23-81.132); the defence is entitled to require that the device’s technical characteristics appear in the case file, rather than being presumed.

3. Actual knowledge of the code and of the encryption

The offence requires intent. It must be established that the person concerned knew the code requested and that the device was equipped with a means of cryptology “of which the defendant was aware”. The Cour de cassation quashed a conviction on the ground that the trial courts had failed to carry out this inquiry (Cass. crim., 9 March 2022, no. 21-83.557). A phone belonging to a third party, a device no longer in use, a code that has been forgotten or never known: these are all circumstances in which the intentional element may be lacking. It is for the prosecution to establish it, not for the person prosecuted to prove the contrary.

4. A demonstrated link between the device and an offence

The provision requires that the means of cryptology may have been “used to prepare, facilitate or commit a serious crime or other offence”. The Constitutional Council (Conseil constitutionnel) has set a limit: the police or judicial investigation must have “made it possible to identify the existence of data processed by the means of cryptology” (Decision no. 2018-696 QPC of 30 March 2018). Investigators cannot, therefore, demand a code “blindly”, with no lead connecting the device to the facts. The trial courts retain a degree of latitude in their assessment, but it remains open to challenge case by case, in light of the concrete evidence in the file.

5. Proportionality and privacy: a question left open

Whether the mechanism complies with the right to respect for private life (Article 8 of the Convention) has not been settled: in the Minteh case, this ground was dismissed solely because it had never been raised before the French courts. Yet in related areas of litigation, such as refusal to submit to identification measures (relevés signalétiques), the Criminal Division accepts that liability may be excluded following a proportionality review carried out in concreto by the trial courts (Cass. crim., 29 March 2023, no. 22-83.458). This argument must be raised at first instance if it is to be preserved. Further downstream, the use of the data is subject to its own safeguards: absent consent, the Court of Justice of the European Union (CJEU) requires prior review by a judge or an independent authority (CJEU, Grand Chamber, 4 October 2024, Case C-548/21), a requirement that the Criminal Division confines to cases where the person did not consent to the search (Cass. crim., 19 May 2026, no. 25-87.563).

What to know before deciding, in police custody (garde à vue)

Three points should be borne in mind. First, the request for the code may lawfully be made in the absence of a lawyer: the Cour de cassation treats the examination of a phone as equivalent to a search (perquisition), not an interview (audition) (Cass. crim., 12 January 2021, no. 20-84.045). All the more reason to request the assistance of counsel from the first hour and to consult them before making any decision. Second, refusal does not render the device unreadable: Articles 230-1 et seq. of the French Code of Criminal Procedure allow recourse to qualified persons and experts to decrypt the data. Third, handing over the code is neither an admission nor an acknowledgement of guilt (as the Constitutional Council has expressly held), whereas the right to remain silent about the facts remains entirely intact: the question of the code is legally distinct from it.

The Minteh decision: a confirmation, not a novelty

In Minteh v. France, a man convicted for refusing, while in police custody, to hand over the codes to his phones argued that his conviction infringed his right not to contribute to his own incrimination. The European Court declared the application inadmissible: the data on a phone that has already been seized exists independently of its holder’s will and can be obtained by way of expert examination; requesting it does not, therefore, amount to extracting a confession.

This position had long been settled under domestic law. The Constitutional Council had formulated it in the same terms as early as 2018, and the Cour de cassation had applied it, precisely in this applicant’s own case, as early as 10 December 2019 (no. 18-86.878), before the Plenary Assembly enshrined the position on 7 November 2022. The Strasbourg decision therefore changes neither the conditions of the offence nor the lines of defence set out above. It does, however, serve as a reminder of a procedural requirement: a ground not raised before the French courts, such as proportionality, is lost for all subsequent purposes, including before the European Court.

Frequently asked questions

1. Must you disclose your phone code to investigators?

No provision requires you to enter your own code, and the right to remain silent still applies. But refusing to disclose it, where it has been lawfully requested and the conditions of the offence are satisfied (the warning, proven encryption, knowledge of the code, a link to an offence), constitutes a punishable offence. The decision should never be taken without advice from a lawyer.

2. Can you refuse without being convicted?

Yes, where one of the conditions of the offence is missing: an irregular requisition or one lacking the required warning, no proof of a means of cryptology, a code unknown to the person concerned, or no link to an offence. It is the examination of these points, within the proceedings, that determines whether the refusal is punishable.

3. Can investigators demand the password to a computer?

Yes: Article 434-15-2 covers any means of cryptology and applies to computers just as much as to phones, provided the device encrypts its data (Cass. crim., 9 March 2022, no. 21-83.557). The same conditions and the same lines of defence apply.

4. What penalty does a person prosecuted on this charge face?

Three years’ imprisonment and a €270,000 fine; five years and €450,000 in the aggravated case. This offence is added to any principal offences being prosecuted, and the conviction is entered on the criminal record.

5. Can investigators access the phone without the code?

Often, yes: the French Code of Criminal Procedure allows recourse to qualified persons and experts to decrypt the data (Articles 230-1 et seq.). This is, in fact, the central argument accepted by the European Court. Refusal, therefore, does not necessarily prevent access to the content; it does, however, expose the person to prosecution.