Pattern, PIN or Face ID: which is stronger?
The numbers
| Lock | Possible combinations | Main weakness |
|---|---|---|
| 6-digit PIN | 1,000,000 | Birthdays and simple number runs |
| 5×5 pattern, the shortest allowed (6 dots) | Up to about 19 million | Simple shapes and initials |
| 5×5 pattern, longer | Grows quickly with every dot you add | Harder to remember |
We counted the 6-dot figure ourselves. It's every 6-dot order the app accepts, where a line passing over an unused dot joins it. Many of those moves are hard to draw, because your finger has to steer around other dots. With straight lines only, it's closer to 2.3 million at best. So treat 19 million as a ceiling, and use 8 dots or more.
Why people's choices matter more
Those numbers assume every pattern is equally likely. People don't choose that way. It's natural to draw letters and simple shapes, and those are the first things someone would try. So a pattern's real strength depends on you:
- Use 8 dots or more. Every extra dot helps.
- Add several turns, and cross your own line if you can remember it.
- Avoid initials, squares, triangles, and anything you've used elsewhere.
Someone watching changes the answer
A pattern is a shape, which can be easy to remember after seeing it once. In one US study of Android's smaller grid, onlookers copied a 6-step pattern about 64% of the time after a single viewing, and 6-digit PINs were harder to copy. We don't know of a study of 5×5 grids, but the lesson carries over: shield your screen when you draw it. If you're often around people who could watch, a PIN may be the better choice. FirstHour lets you choose either.
If you use VoiceOver, a PIN is easier to enter, so FirstHour tells you that when you choose.
Where Face ID fits
Apple says the chance a random person could unlock an iPhone with Face ID is less than 1 in 1,000,000 with a single enrolled appearance. It says that chance is higher for twins, siblings who look like you, and children under 13.
- FirstHour's app lock can use Face ID or your iPhone passcode, to stop someone casually opening the app.
- The Vault doesn't open with Face ID. It needs your pattern or PIN, because that's what the key is made from. Someone who knows your iPhone passcode, or holds your iPhone up to your face, still can't open it that way.
Questions
Can I use my iPhone passcode as my Vault PIN?
Please don't. The point of a separate lock is that knowing your passcode isn't enough. Pick something different.
What if I forget my pattern?
Use your recovery phrase. Here's how.
Sources
- About Face ID advanced technology, Apple Support
- Towards Baselines for Shoulder Surfing on Mobile Authentication, Aviv and others
- News on the same study, UMBC