How Secure Is Face ID? (And When a Passcode Is Safer)

Face ID is very secure against strangers. Apple puts the odds of a random person’s face unlocking your iPhone at less than one in a million, and the face data stays locked inside the Secure Enclave. But Face ID is a convenience layer over your passcode, not a replacement for it, and in a few specific situations a passcode protects you better.

So how secure is Face ID?

For the everyday threat, which is someone who isn’t you picking up your phone, Face ID is genuinely strong. Apple’s published figure is that the chance a random person could look at your iPhone and unlock it is less than 1 in 1,000,000 with a single enrolled appearance. Compare that to a four-digit passcode, where there are only 10,000 combinations, and you can see why biometrics caught on.

That headline number comes with real caveats, though, and Apple states them plainly. The odds are higher for identical twins or siblings who look a lot like you, and for children under 13, whose facial features aren’t fully formed. And the statistic only covers a stranger’s face happening to match. It says nothing about the other ways a phone gets unlocked, which is where the interesting security questions actually live.

So the honest one-line answer is this: Face ID is excellent at keeping strangers out, and it’s a convenience feature sitting on top of your passcode rather than something stronger than it. Both of those things are true at once, and understanding the second one is what lets you use it wisely.

How Face ID actually works

Face ID runs on the TrueDepth camera system at the top of the screen. When you glance at your phone, it projects around 30,000 invisible infrared dots onto your face and reads them back with an infrared camera, building a detailed depth map rather than an ordinary photo. Because it reads shape and depth in infrared, it works in the dark and can’t be fooled by a flat picture the way a simple camera could.

That depth map and infrared image are handed to a part of the phone’s neural engine that lives inside the Secure Enclave, a separate, locked-down chip. There, they’re turned into a mathematical representation of your face and compared against the data from when you enrolled. Two things about that process matter for your privacy:

• The face data never leaves your device. It isn’t sent to Apple, and it isn’t included in your iCloud backup.
• The representation is encrypted with a key only the Secure Enclave can use, so even the rest of iOS can’t read it.

By default, Face ID also uses attention awareness. It checks that your eyes are open and pointed at the phone before it unlocks, which is a quiet but important safeguard: it stops someone from holding the phone up to your face while you sleep. You can turn that off for accessibility reasons, but leaving it on is the safer choice.

Face ID also adapts as you change. It updates its stored math when you grow a beard, put on glasses, or change your makeup, and on recent iPhones it can still recognize you in a mask or sunglasses. That flexibility is convenient, but it’s worth remembering that it’s still matching the physical you, which is the root of both its strength against strangers and its weakness in the situations below.

What Face ID protects you from

It helps to be concrete about the threats Face ID handles well. If your phone is lost, stolen, or just left on a table, a passerby has essentially no way to get in with their own face. The one-in-a-million figure means the biometric front door holds against the people you’re most likely to encounter.

Face ID also sidesteps shoulder-surfing. A passcode can be watched and memorized as you tap it in a café or on a train; your face can’t be copied by someone glancing over your shoulder. For the ordinary, everyday risk of a stranger getting into your phone, biometrics are both more convenient and harder to steal than a short passcode typed in public. That’s a real security win, not just a comfort feature.

The same locked-down check guards more than the lock screen, too. Approving an Apple Pay purchase, filling in a saved password, or opening an app that supports biometric unlock all lean on the same Secure Enclave match. A stranger who can’t get past your face can’t approve a payment or read a saved login either, so it’s one mechanism doing a lot of unseen work in the background.

Where Face ID is weaker than you think

The gaps in Face ID aren’t about someone faking your face. They’re about the fact that your face is attached to you and visible.

The big one: your passcode always overrides Face ID. If someone knows your passcode, Face ID is irrelevant, because they can unlock the phone the old way, and even re-enroll their own face or turn Face ID off. That’s why the passcode, not your face, is the real key to the device. We go deeper into that in what someone can do with your iPhone passcode.

The second gap is physical. Because a scan can happen just by pointing the phone at your face, Face ID can be used against you in a way a memorized passcode can’t. Someone who grabs your phone during an argument, or a situation where you’re pressured to comply, can potentially get in by holding it up to you. A passcode locked in your memory can be withheld; a face on the front of your head is harder to hide. This is the scenario we cover in what to do if you’re forced to unlock your phone.

Face ID vs your passcode: which is the real lock?

It’s tempting to treat Face ID and your passcode as two equal options for locking the phone. They’re not. Your passcode is the foundation, and Face ID is a fast way to stand in for it most of the time. Here’s how they compare on the things that matter.

Factor	Face ID	Passcode
Strength against a stranger	Very high (under 1 in 1,000,000)	Depends on length; a 4-digit code is weak
Can be watched and copied	No	Yes, if typed in public
Can be used on you physically	Yes, by pointing the phone at you	No, it’s in your memory
Overrides the other	No	Yes, always
Survives a restart	No, passcode required	Yes, it’s the fallback
Speed and convenience	Excellent	Slower

The pattern is clear. Face ID wins on convenience and on stopping strangers, while the passcode wins on the harder cases: being compelled, surviving a restart, and being the ultimate key. The strongest setup uses both, with a passcode good enough to deserve that trust. A six-digit or, better, an alphanumeric passcode turns the fallback into a genuinely tough lock instead of a weak one.

When a passcode is actually safer

iOS is built so that a passcode is required, and Face ID is temporarily disabled, in exactly the moments when biometrics are riskiest. Face ID switches off and demands your passcode after any of these:

• The phone restarts.
• It hasn’t been unlocked for 48 hours.
• There are five failed face-match attempts.
• You hold the side button and a volume button together for a moment.
• You lock it remotely with Find My.

That fourth one is worth committing to memory. Squeezing the side button and a volume button brings up the power-off screen and, more usefully, forces the phone to require the passcode on the next unlock. If you’re ever heading into a situation where you’d rather your face couldn’t open the phone, a border crossing, a protest, any moment of pressure, that gesture takes a second and puts the passcode back in charge. It’s the single most practical trick in this whole article.

What this means for your private photos

All of this has a direct bearing on where your most sensitive photos should live. Face ID unlocking your phone is only the outer door. Once the phone is open, your Photos library is right there, and anything that unlocks the device, whether that’s your face or your passcode in someone else’s hands, exposes it.

That’s the reasoning behind an on-device vault like Arca. When you move a photo into Arca, it’s encrypted with AES-256-GCM using a key derived from your PIN through Argon2id, and it lives in the app’s own container, separate from the Photos library. Face ID can act as a quick unlock for the app, but the real secret is the PIN, which stays in your head and never leaves the device. There’s no server and no account, so the photo was never uploaded anywhere to begin with. And because Arca offers a decoy vault, even an unlock done under pressure can open a separate, innocuous set of photos rather than the ones you actually want kept private.

To be precise about the limits, as always: a vault only protects the photos you move into it, and you have to delete the originals from your camera roll or an exposed copy stays behind. It isn’t a backup, and it can’t protect a photo you’ve already sent to someone else. What it does is add a lock that your face alone can’t open, so the outer door and the inner door don’t share a single key. You can read more about the model on our security page.

Setting up Face ID the smart way

Used well, Face ID gives you real everyday security without much friction. A few habits make it noticeably stronger:

• Set a long passcode. Move from four digits to six, or ideally to an alphanumeric passphrase. It’s the true foundation, and it’s what everything falls back to.
• Keep attention awareness on. It stops your phone from being unlocked while you’re asleep or not looking.
• Learn the disable gesture. Holding the side button and a volume button forces the passcode, which is your fastest defense in a tense moment.
• Don’t rely on the outer lock alone for private photos. Keep the handful that truly matter in an encrypted vault with its own PIN, so unlocking the phone doesn’t automatically expose them.

Face ID isn’t overhyped, and it isn’t a weak point either. It’s a very good front door. The mistake is assuming a good front door is the whole house. Pair it with a strong passcode, know how to switch it off in a hurry, and keep your most private photos behind a second lock that your face can’t open on its own.