Pattern, PIN or Face ID: Which Lock Is Safer?
A long passphrase is the strongest of the four. Face ID and a PIN are safe mainly because the iPhone limits how many guesses anyone gets. A drawn pattern has fewer real possibilities than it looks, so make it long.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- What matters is who limits the guesses. A 6-digit PIN is fine when the phone locks out wrong tries. It is weak once someone copies the data.
- Face ID is convenient, not secret. Someone can hold the phone up to your face.
- Patterns need length. On Cryptile's 4×4 grid, 8 or more dots is the minimum we recommend.
How do the numbers compare?
| Lock | Possibilities | Weak spot |
|---|---|---|
| 4-digit PIN | 10,000 | Watched once, it is gone |
| 6-digit PIN | 1,000,000 | Same: watched once, it is gone |
| Face ID | under 1 in 1,000,000 random match (Apple) | Your face, a look-alike sibling, a twin |
| Pattern, 6 dots, 4×4 grid | about 5.7 million | Smudges, shoulder-surfing, offline guessing |
| Pattern, 8 dots, 4×4 grid | about 2 billion | Same, but far slower to guess |
| Long passphrase | far more than any of these | You have to type it |
Apple says the chance a random person unlocks your iPhone with Face ID "is less than 1 in 1,000,000". It is higher for twins, siblings who look like you, and children under 13. After five failed Face ID attempts, a passcode is required (Apple: about Face ID).
Why is my iPhone passcode safe with only six digits?
Because the iPhone does the counting. You cannot try a million codes on the lock screen. Apple also offers Erase Data after 10 failed attempts, and calls a custom alphanumeric code the most secure option (Apple: set a passcode).
The risk is not guessing. It is someone watching you type it, then using it to open everything on the phone.
Is a pattern weaker than a PIN?
It depends on the length. A 6-dot pattern on a 4×4 grid has more combinations than a 6-digit PIN. But people draw letters, corners and simple shapes, which cuts the real number a lot.
In Cryptile the pattern is not just a screen to get past. It makes the encryption key. That has an honest downside, which our threat model states. If someone has both the vault files and this phone's device key, they can guess patterns offline on a computer:
- 4 dots: seconds
- 6 dots: minutes
- 8 dots: hours
- 10 dots: about a week
- 12 or more: years
That device key sits in the iPhone Keychain behind your passcode. Without it, the pattern cannot be guessed this way at all.
Then why does Cryptile use a pattern?
Because a different pattern can open a different vault, and the app shows no list of vaults. A face can only open one thing. Patterns are also quick to draw with one hand. The 9-word recovery phrase is the strong secret behind it: about 96 bits. Keep it on paper.
How do I pick a strong pattern?
- Use 8 or more dots. Cryptile asks for at least 6 on a new vault.
- Cross over lines and change direction. Avoid letters and the outer edge.
- Do not reuse your phone's unlock shape anywhere.
- Draw it where nobody can watch. Wipe the screen now and then.
What this doesn't protect against
No lock helps if someone watches you unlock and then takes the phone. Malware on an unlocked phone can read what is open. A short pattern or PIN can fall quickly to anyone who already holds the device's keys.
Do it with Cryptile
Cryptile derives each vault's key on your device from the pattern you draw. There is no account and no server, and the developer never holds keys.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos, with encrypted iCloud backup included. Plus removes the limits for $19.99 a year (7-day free trial) or $39.99 once.