How Strong Is Your Unlock Pattern? (Free Checker)
Runs entirely in your browser. Your pattern is never stored or sent.
This tool needs JavaScript. The table below has the same numbers.
Draw a pattern on the 4×4 grid: drag across the dots, or tap them in order. Do not draw your real pattern. Draw one of the same length.
Length is what makes a pattern strong. On Cryptile's 4×4 grid, a 6-cell pattern is one of about 5.8 million, and an 8-cell pattern one of about 519 million. Use 8 or more cells.
Try Cryptile free: join the beta on TestFlight
How many patterns are there?
On a 4×4 grid there are 16 cells. A pattern is an order of different cells, and any cell can follow any other. So a pattern of length k has 16 × 15 × … choices, k numbers multiplied together.
| Cells | Possible patterns | Time to try all, large GPU rig |
|---|---|---|
| 4 | 43,680 | under a second |
| 5 | 524,160 | about 10 seconds |
| 6 | 5,765,760 | about 2 minutes |
| 7 | 57,657,600 | about 19 minutes |
| 8 | 518,918,400 | about 3 hours |
| 9 | 4,151,347,200 | about 23 hours |
| 10 | 29,059,430,400 | about 7 days |
| 12 | 871,782,912,000 | about 7 months |
| 14 | 10,461,394,944,000 | about 7 years |
| 16 | 20,922,789,888,000 | about 13 years |
On average the right pattern turns up halfway through.
What are the assumptions?
- The attacker has your files and your device secret. Cryptile mixes the pattern with a secret in the iPhone Keychain. Without that secret, patterns cannot be guessed offline at all.
- Each guess is slow on purpose. The key is made with PBKDF2-SHA512 at 600,000 rounds.
- About 50,000 guesses a second. That is roughly eight high-end GPUs. One GPU does about 6,000. These are rough estimates, not measurements.
- The attacker knows the length. Trying shorter lengths first adds little.
The full reasoning is in our threat model.
Why is my real pattern weaker than the table says?
People choose shapes: letters, squares, zigzags, starting in a corner. An attacker tries those first. A random-looking 8-cell pattern is far stronger than an 8-cell letter L. Do not draw your real pattern here. Draw one of the same length.
What this doesn't protect against
- Someone watching you draw. The trail shows on screen while you draw. Draw where no one can see.
- Smudges on the screen. Wipe the screen now and then.
- A short pattern. Cryptile needs at least 6 cells for a new vault. We recommend 8 or more.
- Losing it. Lose the pattern and the 9-word recovery phrase, and the vault is gone. There is no reset.
How does Cryptile use the pattern?
Your iPhone turns the pattern into the key that decrypts the vault. A different pattern opens a different vault, and there is no vault list. A pattern is weaker than a passphrase, which is why length matters.