Pattern Lock vs PIN vs Password: Which Is Safer?

A random passphrase is the strongest of the three, a random 6-digit PIN sits in the middle with one million combinations, and a pattern can land anywhere from very weak to very strong depending on the grid size and how long and irregular you make it. A four-dot pattern on a 3×3 grid is easy to guess; a ten-dot pattern with direction changes on a 5×5 grid has far more possibilities than any 6-digit PIN. What matters is not the type of lock but how many realistic choices an attacker must try, and how expensive each try is.

The numbers, side by side

Entropy is measured in bits: each extra bit doubles the number of guesses needed. These are upper bounds that assume every choice is random:

The 5×5 rows are rough upper bounds (25 × 24 × 23 … for each dot), since actual rules about skipping dots vary by app. You can test your own choices with our pattern strength meter and password strength checker. Both run in your browser.

Why real-world entropy is lower

People don't choose randomly. Studies of Android unlock patterns have found that a large share start in the top-left corner, move in straight lines, and use five dots or fewer. Shapes like letters (L, Z, M) are common. Similar bias exists for PINs: 123456, birthdays and repeated digits make up a large slice of real PINs.

So a 3×3 pattern with a theoretical 18.6 bits often behaves like something much smaller. The same is true for a 5×5 pattern if you draw a square or a letter.

A strong pattern on a 5×5 grid:

• Uses at least 8 dots, ideally 10 or more.
• Changes direction several times, including diagonals and knight-like jumps.
• Does not start in a corner and does not form a letter, number or shape.
• Is not the same as your phone unlock or any other pattern you use.

A strong PIN is long (6 digits minimum, more if allowed), not a date, not a keyboard sequence.

A strong password is either a random passphrase of 5 or more words or a random string from a password manager.

Why the iPhone passcode is a special case

Your iPhone passcode benefits from hardware. The Secure Enclave ties the passcode to a key inside the chip and enforces escalating delays after wrong attempts, with an optional wipe after 10. An attacker can't copy the data and guess offline at full speed. That is why a 6-digit iPhone passcode is fine for unlocking the phone.

To change yours on iOS 18 or iOS 26:

1. Open Settings > Face ID & Passcode and enter your current passcode.
2. Tap Change Passcode.
3. On the new passcode screen, tap Passcode Options to pick a Custom Alphanumeric Code or a Custom Numeric Code longer than six digits.

The catch: the passcode protects everything on the phone, including the Hidden album. Anyone who knows it, or watches you type it, gets everything. A second, separate secret for sensitive photos closes that gap. More on that in how to password-protect photos on iPhone.

How slow key derivation changes the math

When an app derives an encryption key from a secret (a password, PIN or drawn pattern), the derivation function decides how expensive each guess is. Functions like Argon2id (memory-hard, the current recommendation) or PBKDF2 (older, hash-based) run the secret through many expensive rounds. On a phone, one derivation takes a fraction of a second, which you never notice. For an attacker trying millions of guesses on copied data, that same cost is multiplied by every guess.

Some illustrative arithmetic, assuming an attacker can do 10,000 guesses per second against a slow derivation:

• 6-digit PIN (20 bits): about 100 seconds to try everything.
• 6-dot 5×5 pattern (27 bits): a few hours.
• 10-dot 5×5 pattern with no obvious shape (well above 40 bits upper bound): years, if it really is irregular.
• 5-word passphrase (64 bits): far beyond any practical attack.

The lesson is honest and slightly uncomfortable: slow key derivation helps a lot, but it can't rescue a short secret. If a vault is protected only by a 4-digit PIN and an attacker copies the encrypted files, slow hashing buys minutes, not years.

Where a drawn pattern makes sense

sigil. unlocks each vault's 256-bit key with a pattern you draw on a 5×5 dot grid, hardened with Argon2id and bound to the phone's secure chip, so guessing can't be moved off the device. We chose a pattern because it is faster to enter one-handed than a long passphrase and harder to shoulder-surf than a short PIN when it is long and irregular. It is not magic: a short or shape-like pattern is weak, and we'd rather you know that. Our pattern strength meter shows how a given pattern scores before you use it.

Two more details matter. Each pattern opens its own vault, so different patterns can keep different sets of photos apart (see multiple hidden vaults). And because nobody can reset a forgotten pattern, a 12-word recovery phrase is your only way back in.

Observation attacks

Entropy assumes the attacker hasn't seen you enter the secret. In practice:

• Shoulder surfing: patterns are easy to memorize from a glance if they're short and shapely. PINs typed quickly are harder to catch, but not much.
• Smudges: finger oil can reveal pattern paths on a glossy screen.
• Cameras: a security camera or a phone filming over your shoulder defeats every option.

Cover the screen with your other hand, draw or type where nobody is behind you, and don't reuse the same secret on several devices.

Which to use

• Phone unlock: a 6-digit or alphanumeric iPhone passcode plus Face ID. Hardware rate limiting makes this solid.
• Sensitive photos: a separate secret that is different from your passcode, either a long random PIN, a passphrase, or a long irregular pattern on a 5×5 grid, combined with slow key derivation, a key bound to the device and real encryption, such as pattern encryption.
• Backup of that secret: a recovery phrase written on paper and stored somewhere safe.

Pick the format you will actually use correctly every day, then make it long.