How do you choose a strong phone passcode?

Your passcode does two jobs. It keeps people out of your phone, and on an iPhone it is part of the key that encrypts your data. A longer, less guessable code makes both jobs harder to beat. We checked Apple’s iPhone User Guide for iOS 27, Apple Platform Security and Google’s Android Help on 2026-10-09. To test a code idea without typing your real one, try our password strength checker.

Why length matters on an iPhone

Apple’s Platform Security guide says the passcode “provides entropy for certain encryption keys”, and that “the stronger the user passcode is, the stronger the encryption key becomes”. Guesses have to happen on the phone itself, and each one takes about 80 milliseconds. Apple’s example: trying every six-character code of lowercase letters and numbers would take “more than five and one-half years”.

The Lock Screen adds waits after wrong guesses:

Wrong tries in a row	Wait
1 to 3	None
4	1 minute
5	5 minutes
6	15 minutes
7	1 hour
8	3 hours
9	8 hours
10 or more	The iPhone locks and needs a Mac or PC

Switch to a longer code on iPhone

1. Open Settings and tap Face ID & Passcode (or Touch ID & Passcode).
2. Tap Change Passcode and enter the current one.
3. Tap Passcode Options.
4. Choose Custom Alphanumeric Code or Custom Numeric Code.
5. Enter the new code twice.

Apple calls those two “the most secure options”. Apple also notes that a longer number can be easier to type than a short password, with similar security. A numbers-only code shows the number keypad on the Lock Screen.

You can also turn on Erase Data at the bottom of the same screen. Apple says it erases the iPhone after 10 failed passcodes, so keep a current backup if you use it.

On Android

Google’s Android Help describes the screen lock types:

• PIN: 4 or more numbers, “but a 6 digit PIN is recommended”. Google adds that “longer PINs tend to be more secure”.
• Pattern: a pattern drawn with your finger.
• Password: 4 or more letters or numbers. Google calls “a strong password” the most secure option.
• Swipe or None: Google says these give no protection.

To change it, open Settings, tap Security, then Screen lock. Google also warns that Auto-confirm unlock, which unlocks without the enter key on PINs of 6 digits or more, “may decrease the security of your device”.

Make it hard for the people around you

Strangers are rarely the risk to private photos. The people around you are. A strong code for that case:

• Is not a date anyone could know: birthdays, anniversaries, a child’s birth year.
• Is not a pattern on the keypad, such as a line, a square or repeated digits.
• Is not reused from your bank card, your old phone or your vault app.
• Is typed out of sight in public. A code someone watched you type is no longer secret. Read what to do if someone knows your passcode.

Apple says Face ID and Touch ID make a strong code practical, because you type it less. You still type it after a restart, after 48 hours, and in a few other cases. See can someone unlock Face ID while you sleep.

A second code for your private photos

A phone passcode guards everything on the phone, and many people share it with a partner or a parent. York Vault opens with its own PIN, passcode or pattern, so a person who knows your phone passcode still cannot open your library. It shows a strength guide as you set your code. It can also shuffle the keypad, so the pattern of your taps is harder to watch. See lock options and which code to choose. Download York Vault.