Your single best protection against anyone unauthorized having access to data is enabling the passcode lock. This allows you to set a code required to wake and gain access to the device.
When Touch ID or Face ID is enabled, you must also have a passcode set, and Apple will ask you for that passcode on a regular basis.
A small number of people seem to avoid adding a passcode to their devices. That is extremely dangerous given how much of our lives can be affected by someone gaining access to an iPhone or other device. So the place to start is making your passcode stronger.
Set up a passcode
If you are setting up a new phone or helping someone else, here are the basics, just in case:
- Go to Settings > Touch ID & Passcode or Face ID & Passcode.
- Tap Turn Passcode On.
- If you want to use the default, a six-digit passcode, tap it in and re-enter it when prompted.
Passcode Options, below, lets you pick an alphanumeric password of letters, punctuation, and numbers.
Many mobile security gurus say that not only are four digits too few to resist cracking, but six aren’t enough, either (six being the default that Apple now suggests when you set up an iPhone or iPad). Experts recommend picking something that’s as long as you’re comfortable with while remaining memorable, with six digits being the absolute minimum.
Picking a three-word phrase separated by a punctuation character is often recommended and provides real security, but can be a pain to enter over and over again. (This is what I do.) For instance, horse-stapler-cracker is 100 million times more difficult to crack than 672940 through brute force algorithms. The former could take under a minute, depending on the hardware; the latter, a couple of centuries.
Apple lets you change your passcode whenever you like via Settings > Touch ID/Face ID & Passcode > Change Password, so you can improve your password today. To choose a stronger password than one that’s six digits long, tap Passcode Options and then tap Custom Alphanumeric Code.
Make sure that however many words it is, it’s at least 20 characters with a special character (like a hyphen) dividing them.
Apple has built-in features to prevent tapping in passwords rapidly using an onscreen keyboard or through external hardware, making even weak passwords difficult to crack when they’re not 0000 or 4567. However, from time to time, companies that provide software to law enforcement and governments have developed workarounds. These hacks typically work only for short periods.
There’s one big waving flag you should notice—what’s the opposite of a warning flag? Your iPhone or iPad retains the previous passcode for 72 hours. Apple lets you know you aren’t sunk if you forget your password during that grace period.
You can also enable the passcode lock remotely if you have an active iCloud account and Find My iPhone enabled on the device.
Require passcode and lock screen access
The Require Passcode option offers a few choices if you don’t enable Touch ID or Face ID, depending on your device:
- With Immediately, you’re asked for the passcode whenever the device wakes—this is also the only option for Touch ID and Face ID. (You can set it to sleep automatically, using Settings > Display & Brightness > Auto-Lock.)
- Longer intervals let the device be unlocked without a passcode for up to the time duration you’ve chosen from the list.
In the Allow Access When Locked section, you can also set which services are available when your device is locked, which is a good way to prevent leakage of information, such as viewing appointments, having access to Siri, or using Messages to reply.
This list used to be a few items long. Now it has 11 choices!
As a nuclear option, you can set your device to self-destruct—destroy its data, at least—by switching on Erase Data at the bottom of the settings list. If there are more than ten failed attempts to enter the passcode, boom! What do you lose? Only items created since the last iCloud backup (or Finder sync if you back up via a Mac).
Apple says entering the same wrong passcode doesn’t count toward the ten failed attempts limit.
A passcode may be required in several cases, as described in how to set up Touch ID and Face ID.
Revert to a passcode for safety
There will be times when you will want to revert to a passcode instead of Touch ID or Face ID for personal safety, extra security, or in certain legal situations. In the United States, while the law isn’t yet fully established, it appears that in criminal proceedings, the government can compel the use of a fingerprint but can’t compel you to give up your password.
You can accidentally trigger an Emergency SOS call when using some of the below sequences. Apple’s support site explains how to avoid that.
If you want to force the operating system to disable Touch ID or Face ID, you can:
- Power down: Power down your device via Settings > General > Shut Down or one of the methods below. On restart, it’s disabled.
- Disable biometrics: You can use a feature designed for emergencies to disable biometrics. With all new phones starting in 2017, holding down either volume button and the side/top button disables Touch ID and Face ID, while bringing up the Slide To Power Off option. You can tap Cancel, which prompts entry of the passcode, or use the slide to power down.
- Five bad logins: Make five bad login attempts with your finger or face.
- Use Medical ID on an iPhone: Tap or press the side or top button and swipe to show a passcode screen without using an enrolled fingerprint or having your face straight on. Tap the Emergency link and then Medical ID. After you exit Medical ID, a passcode must be used to unlock the phone.
