In the UK that is true, but it's more complex in the US. My understanding of a recent decision is that the government can compel delivery of a password only if they've already proven from other means some specific evidence that should be available which is protected by that password (since in that case there is already "incrimination" from means other than self-incrimination).