How to set a strong iPhone passcode
The weak point of a passcode is rarely the maths. It’s the people who watch you type it.
In short
Go to Settings › Face ID & Passcode (or Touch ID & Passcode), tap Change Passcode, then tap Passcode Options and choose Custom Alphanumeric Code or Custom Numeric Code — the two options Apple describes as the most secure. A longer code with letters is harder to guess, and much harder to read over your shoulder, than four or six digits.
Key takeaways
- Apple’s most secure options: Custom Alphanumeric Code and Custom Numeric Code.
- With Face ID or Touch ID, you rarely have to type a long code.
- For 72 hours after a change, the old code can still be used once to reset it.
Why four or six digits is weak
A short numeric code is quick to type, and that is exactly what makes it easy to steal. A few taps on a large keypad can be read from across a table, caught by a camera, or remembered after watching you unlock your phone a couple of times. Many codes are also easy to guess: a birth year, a repeated digit, a straight line on the keypad.
Whoever knows your passcode can unlock your iPhone and everything that relies on it, including the Hidden album in Photos.
Choose a stronger code
- Custom Alphanumeric Code: letters, numbers and symbols, typed on a full keyboard. Far more combinations, and much harder to follow from a distance.
- Custom Numeric Code: digits only, but as many as you like. Every extra digit helps.
- Avoid dates, repeated or sequential digits, and anything someone close to you could guess.
Face ID or Touch ID makes a long code painless, because you only type it when iPhone insists — for example after turning it on or restarting it, when it hasn’t been unlocked for more than 48 hours, or after five failed Face ID or Touch ID attempts.
Change your passcode
- Go to Settings › Face ID & Passcode (Touch ID & Passcode on models with Touch ID), and enter your current passcode.
- Tap Change Passcode.
- When asked for a new code, tap Passcode Options and choose Custom Alphanumeric Code or Custom Numeric Code.
- Enter the new code, then enter it again to confirm.
Do it where nobody can see your screen. If Stolen Device Protection is on and you are away from a familiar location, changing the passcode requires a one-hour security delay.
After changing it
- For 72 hours, your previous passcode can be used once to reset the new one if you forget it. If someone else knew the old code, tap Expire Previous Passcode Now in the same settings screen.
- Set a short Auto-Lock time in Settings › Display & Brightness › Auto-Lock, so the phone locks itself when you put it down.
- Consider Erase Data, at the bottom of the passcode settings: it erases the iPhone after 10 failed attempts. Turn it on only if you keep a recent backup.
A passcode protects the phone, not everything on it
Once someone has your passcode, the phone is open to them. For photos and documents that must stay private even from people who might know it, add a second, separate secret. Latent vaults open with their own 5×5 pattern or password, unrelated to your iPhone passcode.