Is a 6-Digit Passcode Enough to Secure Your iPhone?

For most people, a random 6-digit passcode is genuinely enough. The iPhone’s Secure Enclave forces a growing delay after every wrong guess, so working through a million combinations would take years, not minutes. The real weakness is rarely the digit count. It’s picking a guessable code like 1234 or a birth year, or letting someone watch you type it.

Is a 6-digit passcode enough? The short answer

Yes, for the vast majority of people and threats, a 6-digit passcode is enough, as long as it isn’t an obvious one. This surprises people, because six digits doesn’t sound like much. A million combinations feels guessable in a way that a long password doesn’t. The reason it holds up isn’t the size of the number by itself. It’s that Apple’s hardware refuses to let anyone try those combinations quickly.

The thing protecting your phone isn’t really the passcode’s length. It’s the Secure Enclave, a dedicated security chip that meters out guesses one slow attempt at a time and locks the door longer with each failure. Once you understand that mechanism, the whole question of “how many digits” looks different, and a lot less scary.

So the honest answer has two halves. The math and the hardware are on your side, which is the reassuring part. And the part that actually needs your attention is not the digit count at all, but whether the specific passcode you picked is one an attacker would try first.

How the iPhone actually stops passcode guessing

An attacker with your phone can’t just run software that tries 000000, 000001, 000002 and so on at machine speed. The Secure Enclave sits between every guess and the encryption keys, and it enforces escalating time delays that a restart won’t reset. In practice the lockouts climb like this:

Consecutive wrong attempts	What happens
1 to 5	Try again right away
6	Locked for 1 minute
7	Locked for 5 minutes
8	Locked for 15 minutes
9 or more	Locked for 1 hour
10 (if you enable it)	Device erases all its data

Those delays are the whole game. Five quick tries and then a wall of forced waiting means an attacker can’t make more than a handful of attempts an hour, no matter how fast their computer is. And if you turn on “Erase Data” in Settings under Face ID & Passcode, the phone wipes itself after ten failed attempts, so a thief gets exactly ten guesses before the data is gone for good.

It’s worth being precise about what this protects. The Secure Enclave guards your device against someone physically holding it and guessing. It’s the reason a random 6-digit passcode is strong despite being “only” a million options, and it’s why the digit count matters less than the delays do.

Why 6 digits is stronger than it sounds

Put the two things together, the size of the number and the forced delays, and the numbers get reassuring fast. A 4-digit passcode has 10,000 combinations; a 6-digit one has 1,000,000, a hundredfold jump. Now feed that into the lockouts. By Apple’s own calculation, with the escalating delays it would take roughly 114 years to try every possible 6-digit passcode. Nobody is standing in a parking lot for a century tapping in codes.

Here’s how the common options actually compare:

• 4 digits (10,000 combinations). Weaker, and worth upgrading. Still slowed by the same delays, but a smaller haystack.
• 6 digits (1,000,000 combinations). The default since iOS 9, and the sweet spot of security and convenience for most people.
• Custom alphanumeric (billions and up). By Apple’s estimate a six-character letters-and-numbers passcode would take more than five and a half years to brute-force on the device, and longer ones climb from there.

The takeaway isn’t that everyone needs a long alphanumeric passcode. It’s that a random six digits already lands you in “practically impossible to brute-force on the device” territory. Which means the effort is better spent making sure your six digits are actually random.

The real weak point: a guessable passcode

If the hardware is this good, why do phones still get unlocked? Almost always because the passcode was easy to guess, not because it was cracked. People reach for codes that are easy to remember, and “easy to remember” and “easy to guess” are often the same thing. A small handful of patterns account for a strikingly large share of the passcodes people actually choose:

• Sequences and repeats. 1234, 0000, 1111, 123456, 654321.
• Years. A birth year or a recent year like 1990 or 2024, especially as the middle of a 6-digit code.
• Dates. Birthdays and anniversaries in MMDDYY or DDMMYY form, which someone who knows you can guess.
• Keypad shapes. Patterns that draw a line or box on the number pad, like 2580 straight down the middle.
• Repeated pairs. 121212 or 112233, chosen because they’re satisfying to type.

The problem with all of these is that a person who has your phone often also has context: they may know your birthday, or they just try the dozen most common codes first. That’s the attack that actually works, and no amount of Secure Enclave engineering defends against a code the attacker guesses on the third try. This is also why a strong passcode is only one layer. It’s worth knowing what someone can access if they do know your passcode, because the answer is “almost everything,” which is exactly why the code is worth protecting.

When a stronger passcode actually matters

For everyday privacy, keeping a nosy acquaintance or an opportunistic thief out, a random 6-digit passcode is more than enough. There are narrower situations where going longer is reasonable, and it helps to name them without exaggerating the risk.

Specialized forensic tools, the kind sold to law enforcement, have at times been able to extract data from iPhones, usually by exploiting a specific software bug on older or unpatched devices. Apple patches these as they surface, and on modern iPhones there’s no publicly known way to defeat the passcode delays. But if you’re a journalist, an activist, or anyone who might realistically face that class of adversary, a longer alphanumeric passcode is a cheap and large upgrade, because it multiplies the brute-force time even in the rare case the rate limiting is bypassed. Keeping your iPhone updated matters just as much, since those tools live on unpatched bugs.

One built-in defense worth switching on is USB Restricted Mode, which cuts off data access through the charging port once the phone has been locked for an hour. That blunts the cable-based tools many forensic setups rely on, and it’s already on by default, listed as “Accessories” under Face ID & Passcode, so it costs you nothing to leave enabled.

For most of us, though, the more useful move isn’t a longer passcode. It’s turning on “Erase Data,” keeping the phone updated, and never reusing an obvious code. Biometrics help here too, since Face ID lets you keep a long, awkward passcode without typing it constantly, a trade-off we get into in how secure Face ID is.

Your device passcode vs a vault PIN

There’s a second layer worth understanding, because it works differently. Your device passcode is protected by the Secure Enclave’s hardware counter, the thing enforcing those escalating delays. An app running on top of iOS can’t borrow that same counter to guard its own lock. So how does an encrypted vault stay safe if it can’t lean on the hardware to slow guesses down?

The answer is to make each guess expensive in software instead. Arca derives the key that encrypts your photos from your PIN using Argon2id, a deliberately slow, memory-hard function. Every attempt to turn a PIN into the decryption key costs real time and memory, so even an attacker who copied the encrypted data off the phone and tried to guess offline, where no Secure Enclave delay applies, is throttled to a crawl. The photos themselves are sealed with AES-256-GCM, and there’s no server and no account, so the encrypted originals were never anywhere but your device.

To be precise about the limits, because this is where honesty matters: Argon2id makes guessing slow, but it can’t rescue a weak secret. If your vault PIN is 1234, or someone watches you enter it, the cleverest key derivation in the world won’t help. The same rule applies as with your device passcode, choose something not-obvious, and don’t let it be seen. For the specific case of being forced to unlock, a vault with a decoy option protects you in a way a passcode alone can’t, and you can read the full model on our security page.

How to set a passcode you’ll actually keep

Good passcode habits aren’t about paranoia; they’re a few small choices you make once. Here’s the short, practical version:

• Use at least 6 random digits. If you’re still on a 4-digit code, upgrade in Settings under Face ID & Passcode, Change Passcode, Passcode Options.
• Avoid anything guessable. No birth years, no dates, no 1234 or keypad shapes. Random beats memorable here.
• Turn on Erase Data. Ten failed guesses and the phone wipes, which turns a stolen device into a brick rather than an open book.
• Pair it with Face ID. Then a longer passcode costs you almost nothing day to day, since you rarely type it.
• Keep iOS updated. The passcode protections rely on the Secure Enclave and on Apple closing the bugs that forensic tools exploit.

Do those, and you’re past the point where the number of digits is what’s protecting you. Your habits are.

Where Arca fits

A strong passcode locks the whole phone, which is the right foundation. But it’s still one lock on one door, and anyone who gets past it, or simply borrows your unlocked phone for a minute, can open Photos and scroll. That’s the gap a separate vault is built to close.

Arca keeps your private photos in an on-device vault, encrypted with AES-256-GCM and unlocked by its own PIN, stretched through Argon2id, in a container separate from your camera roll. It has its own lock, so unlocking the phone doesn’t unlock the vault, and with no server behind it, the photos were never uploaded anywhere. It won’t back your photos up for you, and it can’t protect a PIN you let someone see, so use it as one deliberate layer: a strong device passcode on the outside, and your most private photos sealed behind a second lock within.

Download Arca on the App Store to keep your most private photos behind a second lock, encrypted on your device.