Absolutely. Even so, it used to be the case that judges could detain people this way indefinitely. Outside of the US, many countries offer no such legal protection at all, refusing to give up a password is itself a crime, in some cases with penalties exceeding the original charges.

People should absolutely familiarize themselves with the laws surrounding this in their jurisdiction even if they're doing nothing wrong - legitimately forgetting a password and defiantly refusing to share it are often treated the same way by the criminal justice system.