How to Create a More Secure Passcode on Your iPhone or iPad

by

iphonecreateapasscodeApple's iPhones have long been protected by numeric passcodes, giving iOS users a way to protect keep their devices safe from hackers and prying eyes. Over the years, passcodes have been supplemented by Touch ID, Apple's fingerprint recognition system, but the passcode is still the iPhone's main line of defense.

A passcode is required to set up Touch ID, and Touch ID is automatically disabled after 48-hours until a passcode is input by an iPhone or iPad's owner. In the United States, passcodes are especially important because the law suggests that while law enforcement officers can require you to provide a fingerprint to unlock a device, the same is not true of a passcode.

For a long time, passcodes were four-digit numeric codes by default, but with iOS 9, Apple began using a six-digit passcode as the default option. Six-digit passcodes offer 1 million possible combinations instead of 10,000, making a passcode harder to crack.

Apple doesn't advertise it, but the iOS operating system offers an option to make your passcode even more secure through the use of an alphanumeric passcodes or custom length numeric passcodes. Alphanumeric passcodes contain letters and numbers. Both alphanumeric and custom numeric passcodes can be much longer than four or six digits.

Passcodes are currently in the spotlight because of an ongoing security debate between Apple and the FBI. Apple has been ordered to help the FBI access data on the iPhone 5c owned by one of the shooters involved in the 2015 San Bernadino attacks.

To do so, the FBI has asked Apple to create software that would eliminate the iOS feature that erases an iPhone after 10 failed passcode attempts, removes the time limits between passcode entries, and allows passcodes to be input electronically. Apple is opposing this order and it's not clear how the issue will play out, but should the FBI gain a tool to access iPhones in this manner, it would take just upwards of a half an hour to break into a phone with a 4-digit passcode. With an alphanumeric passcode, such a tool would be next to useless because of the sheer amount of time it would take to guess a passcode with millions of possible combinations.

Creating an Alphanumeric Passcode

Creating an alphanumeric passcode is a process that can be done with a few taps and about five minutes of your time.

creatinganalphanumericpasscode

  1. Open the Settings app on your iPhone or iPad.
  2. Scroll down to "Touch ID & Passcode" and tap on it.
  3. If you already have a passcode enabled, you will need to enter it to access the passcode options.
  4. Select "Change Passcode" and enter your existing passcode again.
  5. At the screen where you're asked to enter a new passcode, tap on "Passcode Options" located just above the numbered.
  6. Choose "Custom Alphanumeric Code." You can also select "Custom Numeric Code" for a number-only passcode.
  7. Enter your chosen passcode. It can include numbers, letters, and symbols.
  8. Tap "Next."
  9. You'll be prompted to enter the same passcode again to verify the spelling. Enter it again and tap "Done."

After entering an alphanumeric passcode or changing your passcode, Apple will prompt you to use the new passcode as your iCloud Security Code, which is used to protect passwords stored in iCloud Keychain. Click on "Use Same Code" to change it or "Don't Change Security Code" to continue using your old passcode.

passcodeicloudsecuritycode
With an alphanumeric passcode set on an iPhone, instead of a number pad to enter a numeric passcode, you'll see a full QWERTY keyboard complete with access to numbers, letters, and symbols.

alphanumericpasscode
While not as convenient as a simple number code, an alphanumeric password can be harder to crack and just as easy to remember if you use randomly generated combinations of words. For example, "sarcasm-blacken-guilder-epilepsy" or "stitch-quasi-peppery-tuneless," two password phrases generated by 1Password, aren't difficult to remember because they're simple words, but with upwards of 29 characters, they're impossible to guess or brute force. Using an alphanumeric passcode will be more of a hassle than a standard passcode, but with Touch ID, a passcode doesn't need to be entered too often.

Any alphanumeric code used to protect an iPhone should be unique set of words or numbers that are not used for other products, services, or websites, which will make it impossible to obtain through social engineering or phishing attempts.

Top Rated Comments

(View all)
Avatar
58 months ago

Doesn't matter when the FBI gets their way and gets the backdoor they have been itching for.

That is up to you and I. Apple has stuck their neck out. Now the government is quietly trying to cut their head off. They only way they, the government win, is if you an I are silent and don't say anything. Now is the time to call and write and tweet, and make whatever noise can be made because next month will too late.
Score: 6 Votes (Like | Disagree)
Avatar
58 months ago
I'd love an app that when I removed my Apple Watch, it turned off thumbprint on all my devices and required the passcode.
Score: 3 Votes (Like | Disagree)
Avatar
58 months ago
I was not aware that I could be compelled to unlock my phone via fingerprint but not passcode.
Score: 3 Votes (Like | Disagree)
Avatar
58 months ago

For it to be effective, against the FBI, NSA etc. tryimg to brute force your phone (assuming they get through the courts) you would need to not be iCloud enabled with anything you don't want the Feds to have (Apple can give them access to all that via a warrant) and be backing up locally (not in iCloud) as well as synching locally on your computer via iTunes.

Not to mention that the local backups of the phone would need to be encrypted. iTunes offers encryption for them as an option.

Another alternative would be to encrypt the whole disk with something like FileVault 2 (built into OS X), but then you'd also need to encrypt any backups of your computer you maintain - on a TimeCapsule, for instance. They remain unencrypted even if the computer's disk is encrypted, unless you specifically encrypt the backups too.
Score: 3 Votes (Like | Disagree)
Avatar
58 months ago

Doing this since my ip5s , would like to see some stats on 80ms delay, number of digits and the time it takes to brute force it , also , can the 80 ms be ****ed with?

You can do the math: 80ms * 10,000 attempts is 800 seconds, or 13.33 minutes. If you increase it to 6 digits, that's 80,000 seconds or 22.22 hours.

However, the significance of 80ms depends on the iPhone model, or more specifically -- the processor. iPhone 5c or earlier used an A6 processor or earlier. iPhone 5s or later uses an A7 or later processor.

The earlier iPhones (since the 3G, I think) with A6 and earlier enforce the 80ms per attempt by requiring the password to be run through PBKDF2 with enough iterations that it requires 80ms on the encrypted device. Each iteration, it does an operation that uses the device UID burned into the processor at manufacturer.

The device UID can't be read directly. So, a brute-force attack on any other device but the specific encrypted iPhone would require brute force search of the device UID keyspace as well. The device UID is a 256-bit AES key, making this difficult in a reasonable amount of time, or at a reasonable cost.

The later iPhones with the A7 and later added a Secure Enclave. This enforces a limit that changes with the number of consecutive failed attempts. The first 4 attempts, there is no delay. After that, it increases rapidly to as much as 1 hour after 9 attempts. The Secure Enclave even enforces this limit if the device is restarted (and presumably includes a power-cycle).

Unless you choose an easily-guessed 4-digit passcode, it would take over a year to search the entire 10,000 key space, at 1 hour per attempt.

You can find this in https://www.apple.com/business/docs/iOS_Security_Guide.pdf, on page 12.

There have been unconfirmed claims that Apple says they could still compromise the Secure Enclave with a backdoor'ed iOS. But, that seems to contradict their security guide, and I can't imagine why they would go through all the effort to implement a vulnerable Secure Enclave. So, I'm waiting to see an authoritative citation.
Score: 2 Votes (Like | Disagree)
Avatar
58 months ago
Score: 2 Votes (Like | Disagree)

Top Stories

Apple Warns Against Closing MacBooks With a Cover Over the Camera

Friday July 10, 2020 11:12 am PDT by
Apple this month published a support document that warns customers against closing their Mac notebooks with a cover over the camera as it can lead to display damage. Image via Reddit Apple says that the clearance between the display and the keyboard is designed to very tight tolerances, which can be problematic. Covering the camera can also cause issues with automatic brightness and True Tone....

iPhone Users Who Experienced 'Batterygate' Can Now File to Receive Around $25 Settlement From Apple

Monday July 13, 2020 6:50 am PDT by
Earlier this year, Apple agreed to settle a U.S. class action lawsuit that accused the company of "secretly throttling" older iPhone models. Now, eligible iPhone owners are beginning to be notified about their legal rights and options. Under the proposed settlement, Apple will provide a cash payment of approximately $25 to each eligible iPhone owner who submits a claim, with its total payout ...

Possible 'iPhone 12' Battery Certifications Suggest Lower Capacities Than iPhone 11 Series

Monday July 13, 2020 4:22 am PDT by
MySmartPrice has spotted certifications for three new Apple batteries that it believes could be for the upcoming iPhone 12 lineup, despite them being less capacitive than the batteries in the current iPhone 11 series. The batteries are identified with the model numbers A2471, A2431, and A2466, and appear on Safety Korea, China's 3C, and the Danish agency UL Demko. Apple is expected to...

Google to 'Dramatically' Improve Chrome Impact on Mac Battery Life

Sunday July 12, 2020 1:56 pm PDT by
Google will address long-standing battery life issues, particularly on Mac devices, reports The Wall Street Journal. Chrome will improve "tab throttling" by better prioritizing active tabs and limiting resource drain from tabs open in the background. This is said to have a "dramatic impact on battery and performance." Google has reportedly been performing early tests on Mac laptops in...

Arm-Intel-PowerPC Universal Binaries Are Possible

Saturday July 11, 2020 1:42 pm PDT by
Casual MacRumors visitors may not realize that we have a very active PowerPC forum where users discuss issues related to PowerPC Macs that have not been produced since 2006. Threads range from hardware upgrades and software options to nostalgia: Photo by AphoticD Apple's recently announced transition to Apple Silicon (Arm) based Macs raised some interesting questions about future support...

Apple Pays Samsung an Estimated $950 Million for Missing OLED Panel Purchase Targets

Monday July 13, 2020 10:03 am PDT by
Apple in the second quarter of 2020 paid Samsung approximately $950 million for not meeting OLED panel purchase goals established in agreements between the two companies, according to display analysts at Display Supply Chain Consultants. Samsung last week shared guidance on revenue and operating profit for the second quarter of 2020, which included a one-time gain related to its display...

Apple Shares Humorous 'Working-From-Home Thing' Video

Monday July 13, 2020 9:31 am PDT by
Apple today shared a funny video focused on the problems that people working from home have to deal with, including noisy children, chaotic schedules, communication issues, and more. The video focuses on showing off Apple products and their capabilities that can be useful when working from home, such as the ability to scan a document with an iPhone, mark up a PDF, Siri Reminders, and more.The...

SoftBank Considering Possible Sale of Arm Holdings as Apple Gears Up for Arm-Based Macs

Monday July 13, 2020 2:00 pm PDT by
SoftBank, the company that owns chip designer Arm Holdings, is exploring options that include a full or partial sale or a public offering, reports The Wall Street Journal. SoftBank is working with Goldman Sachs Group as an advisor, and the explorations are at an early stage. The Wall Street Journal says that it's unknown how much interest there would be in Arm from financial or industry...

Rumor Suggests New Apple App for Windows Could Be Coming Soon

Tuesday July 14, 2020 1:54 am PDT by
Apple could be working towards the release of a new app for Windows 10, according to a report this week from an Italian website. The blog Aggiornamenti Lumia suggests that an app from Apple is "coming soon" to the Microsoft Store, but stops short of providing additional details. Apple still maintains a Windows version of the iTunes app, which has been discontinued on Mac and replaced by...

Deals: Amazon Taking $400 Off 16-Inch MacBook Pro, Starting at New Low Price of $1,999.99 for 512GB

Monday July 13, 2020 5:34 am PDT by
Amazon has introduced a new low price on Apple's 16-inch MacBook Pro today, including both 512GB and 1TB models. Starting with the 512GB model (2.6GHz 6-Core, 16GB RAM), you can get this notebook for $1,999.99, down from $2,399.00. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running....