PIN or pattern: which is better for a vault?
Guessing: the pattern wins
A 6-digit PIN has 1,000,000 possible combinations. A pattern on a 5×5 grid of dots, even the shortest FirstHour allows (6 dots), has up to about 19 million, and each extra dot multiplies that. Our Pattern, PIN or Face ID page shows how we counted, and why 19 million is a ceiling, not a promise.
The catch is that people don't choose at random. PINs like birthdays and 123456 are the first things anyone tries. For patterns, it's initials, squares and triangles. So the number only helps if your choice is a good one.
Watching: the PIN wins
A pattern is a shape, and shapes are easy to remember after one look. In one online study, watchers who saw one entry copied a 6-step pattern on an Android phone 64.2% of the time, and a 6-digit PIN 10.8% of the time. That study didn't test a 5×5 grid, and Android's pattern lock isn't FirstHour's, so the numbers don't carry over exactly. The lesson does: a pattern is easier for onlookers to copy.
How to choose
- Mostly alone, or on a bus where nobody looks? A pattern of 8 dots or more, with several turns.
- Often around family, coworkers or crowds? A PIN, and shield the screen with your hand.
- Use VoiceOver? Choose the PIN. It's easier to enter, and FirstHour says so when you choose.
- Worried someone close to you knows your habits? Avoid dates and anything they could guess, whichever you pick.
Picking a good one
- Pattern: use 8 dots or more, add turns, and avoid letters, shapes and anything you've used for another lock.
- PIN: use six digits with no meaning to anyone else. Not a birthday, an address or a phone number.
- Don't reuse your iPhone passcode. The point of a separate lock is that knowing your passcode isn't enough.
- Draw or type it with the screen shielded, every time.
How FirstHour handles both
You choose when you set up the Vault. A pattern runs through 6 or more dots on a 5×5 grid and has to have at least one turn. FirstHour doesn't push you past that, so aim higher. A PIN is exactly 6 digits, and FirstHour turns down the obvious ones, six of the same digit and straight runs such as 123456 and 987654. It doesn't turn down a birthday, so that's up to you.
The same waits apply to both: 4 free wrong tries, then 1 minute, then 5, 15 and 60 minutes. Wrong tries never wipe the Vault. Your pattern or PIN is also tied to your iPhone's security chip where it can be, so guessing has to happen on the phone itself. Here's how a pattern becomes a key.
You can switch later. Open the Vault, tap •••, then Change PIN or pattern. If you have a decoy vault and switch between a pattern and a PIN, the decoy is removed, and the pictures in it are deleted, because one unlock screen has to open both. FirstHour tells you only afterward, so move anything you want to keep out of the decoy first. You can set up a new, empty decoy from the ••• menu.
- Face ID can't open the Vault. It needs your pattern or PIN.
- Neither choice helps if someone watches you or you write it down where they can find it.
- Forget it, and you need your recovery phrase. Here's how.
Questions
Is a longer PIN better?
In general, yes, but FirstHour's PIN is 6 digits. If you want something stronger than that, choose a long pattern.
Should I change it now and then?
Change it right away if someone saw you use it. Otherwise, a good one doesn't need changing on a schedule.
Sources
- Towards Baselines for Shoulder Surfing on Mobile Authentication, Aviv and others