Pattern, PIN or biometrics: which lock to choose
How patterns, PINs, passwords, Face ID and fingerprints compare on iPhone and Android, and how to pick a passcode that is hard to guess.
The lock on your phone is the front door to everything else on it. A strong one does not need to be complicated. It needs to resist three things: guessing, watching, and the people you live with.
How they compare
| Method | Hard to guess | Hard to watch | Main weak spot |
|---|---|---|---|
| 4-digit PIN | Low (10,000 options, fewer in practice) | Low | Birthdays and years are common choices |
| 6-digit PIN | Medium (a million options) | Low to medium | Repeated or sequential digits |
| Pattern | Low to medium | Low | Easy to see from across a table, and smudges can show the shape |
| Alphanumeric password | High | Medium | Slower to type, so people keep it short |
| Face ID or fingerprint | High against strangers | High | Someone can hold the phone to your face or finger; the passcode still backs it up |
The short version: biometrics for convenience, backed by a long passcode, is a sensible default for most people. Patterns are the easiest to watch over a shoulder.
A word on biometrics
Face ID and fingerprint unlock are hard for a stranger to fake. Their weakness is different: someone close to you could unlock the phone while you are asleep, or hold it up to you. Your passcode always remains the fallback, so a weak passcode undoes a strong fingerprint.
If you are worried about being made to unlock your phone, you can temporarily turn off biometrics. On iPhone, pressing and holding the side button with either volume button brings up the power screen, after which the passcode is required. Many Android phones have a lockdown option in the power menu; search Settings for "lockdown" if you do not see it. Menu names vary by manufacturer and version.
The people around you
Most snooping is not done by strangers. It is done by people who share a sofa, a car or a bed with you, and they have advantages a stranger lacks: time, repeated chances to watch, and a good guess at what dates matter to you.
- Angle your screen. Patterns and short PINs are easy to learn from across a room after a few looks.
- Wipe the screen. Smudge trails can reveal a pattern on a glossy screen.
- Think about who has your face or finger. A partner or child who can reach you while you sleep can use biometrics. If that worries you, rely on the passcode.
- Know who learned it, and when. If you gave your code to someone during a crisis, a trip or a repair, change it afterward. It is ordinary hygiene, not a statement about trust.
A second lock for private things
If someone else knows your phone passcode and you are fine with that for daily life, the simplest fix is not a stronger phone lock but a second, separate one for the few things that are yours alone. Built-in options include the locked Hidden album on iPhone (which uses the phone's own passcode or Face ID), Google Photos Locked Folder, and Samsung Secure Folder, which can have its own lock. A separate vault app with an unrelated code is another option.
Whatever you use, make that second code genuinely different. A vault PIN that is your phone PIN reversed is not a second lock.
What makes a lock strong
Strength comes from how many possibilities someone would need to try, but only if the choice is random. People pick dates, corners and letter shapes, so the real number is much smaller than the theory.
Guesses are also slowed down. Phones add delays and can erase after many wrong tries. Encryption apps can stretch a code with a slow function such as Argon2, which makes each guess cost time even on a fast computer.
And observation matters. A strong code entered in front of others is a weak code.
Choosing one: a checklist
- Go longer rather than cleverer. Six digits beats four; a password beats six digits.
- Avoid birthdays, anniversaries, years, 123456, 111111, and your bank card PIN.
- For a pattern or path, use more points, change direction, and avoid letters (L, Z, S), straight lines and the outer edge.
- Use a different code for a vault than for your phone, so knowing one does not open the other.
- Do not share it with a partner, friend or child unless you are comfortable with them seeing everything it protects.
- Change it if someone may have watched you enter it. There is no need to change it on a schedule.
Changing it on your phone
iPhone: Settings, then Face ID and Passcode (or Touch ID and Passcode), then Change Passcode. Tap Passcode Options to choose a custom alphanumeric code or a longer number.
Android: open Settings and search for "Screen lock". You can usually choose PIN, pattern or password. A password or a long PIN is stronger than a pattern.
Remembering it
A lock you forget is not much use. Practice a new code several times over the first few days, when nobody is watching. Tie it to a picture or story only you would think of, not a date. If you must write it down, keep the note away from the phone, unlabeled, and destroy it once muscle memory takes over.
VaultWell, coming soon, opens each vault with a path traced on a honeycomb and shows a live strength meter while you trace, so you can adjust before saving. You can try ideas with the path strength tool, which works for any pattern you are considering.
Questions
Is a pattern always weaker than a PIN?
Not always, but usually in practice. A long pattern with turns can be strong; the common shapes people choose are not, and patterns are easy to watch. A six-digit PIN or a password is the safer default.
Can the police or a border officer make me use Face ID?
Rules differ by country and situation, and in some places biometrics are treated differently from a passcode. This is not legal advice. See the border searches guide for general information.