Pattern Lock vs PIN vs Face ID: Which Is Actually Safer?

The question sounds like it should have one answer, and it nearly does, until you ask who you are protecting the phone from. A stranger who finds it on a train, a colleague sitting opposite you at lunch, and a partner who already knows your passcode are three different problems, and the three locks fail against them in a different order. What follows is the ranking, the research behind it, and the part that matters more than any of it: which lock belongs on the phone, and which belongs on the photos inside it.

Against somebody watching you unlock, a pattern is the weakest of the three by a wide margin. In one controlled study of single observation shoulder surfing, attackers reproduced a pattern drawn with visible trace lines around 64 percent of the time, while a six digit PIN fell around 11 percent of the time. A pattern also leaves a physical record: the original smudge attack research recovered the whole pattern from finger grease on the screen in 68 percent of tests under favourable lighting, and part of it in 92 percent. Face ID gives an onlooker nothing at all, which is why it wins on paper, and Apple puts the odds of a random face matching yours at roughly one in a million. Its weakness is a different one. It works while you are asleep and it works when someone holds the phone up to you, and on iPhone it is a shortcut to the passcode rather than a replacement for it, so a watched passcode undoes it. The board size matters too. Almost every published pattern number describes a three by three grid, and a five by five board with a six dot minimum sits in a completely different range. Use Face ID with a long passcode on the device itself, and put a separate credential on the app holding anything you would not hand to a stranger.

The short ranking, and the question that reorders it

Judged on how well each one survives being observed, the order is clear: Face ID first, a long PIN second, a pattern last. Face ID reveals nothing to a watcher, because the credential never leaves your face. A PIN is entered in a small area that a hand can cover, and every extra digit multiplies the guessing space by ten. A pattern is a large gesture drawn across most of the screen, usually with a bright line following your finger, and it is the only one of the three that a person two seats away can simply memorise. That is not a small effect in the research, it is the difference between a coin flip and a long shot.

Then ask a different question. Who actually opens phones without permission? Overwhelmingly it is not a stranger with a camera, it is somebody already in the room: a partner, a flatmate, a colleague, a relative. That person usually knows your passcode, has watched you unlock the phone a hundred times, and does not need any attack at all. Against them the ranking above is irrelevant, because all three locks are already open. The only thing that still holds is a second credential they have never seen, on the app that holds the material worth protecting. Our walkthrough of locking individual apps with Face ID on iPhone covers the built in half of that, and it is worth reading alongside this one.

What each lock gives away to somebody watching

Researchers have measured this rather than guessed at it. In a study of single observation shoulder surfing, a pattern drawn with the trace line visible was successfully reproduced by the observer about 64 percent of the time, while a six digit PIN was reproduced about 11 percent of the time. Switching the trace line off helps a pattern considerably, and covering the keypad helps a PIN, but the gap survives both. The reason is geometry. A PIN is a sequence of small taps in a dense grid, and a single misread digit ruins the whole guess. A pattern is one continuous shape, and a shape is exactly the kind of thing human memory is good at holding after one look.

A pattern also leaves evidence behind after the fact. The original smudge attack work photographed phone screens under controlled lighting and recovered the complete unlock pattern from the grease trail in 68 percent of tests, with part of the pattern visible in 92 percent. A PIN keypad smears too, but the smears do not carry an order, so an attacker learns which digits and not the sequence. Face ID leaves nothing on the glass and nothing in the room. What it does instead is work whenever your face is in front of the camera, including while you sleep, which is a real and specific weakness rather than a theoretical one. Apple mitigates it by requiring the passcode after a restart, after 48 hours without an unlock, and after five failed face matches, and by shipping Stolen Device Protection for the case where a thief already watched you type it.

The arithmetic underneath, and why board size changes it

Every widely quoted pattern statistic describes the Android three by three grid, where paths of four to nine dots give 389,112 possibilities in total. That is more than a four digit PIN at 10,000 and less than a six digit PIN at 1,000,000, and both numbers overstate the real difficulty, because neither pattern choices nor PIN choices are anywhere near random. People start patterns in the top left corner far more often than chance allows and draw letters they already know. People pick 1234 and 0000 and birth years. An attacker who tries the popular choices first is not working through the whole space, only through the crowded end of it.

Board size is the variable nobody mentions, and it dominates the rest. Counting only paths that use six different dots, a five by five board offers 127,512,000 orderings before any drawing rule trims the list, against 1,000,000 for a six digit PIN. Vaultaire uses a five by five board for exactly this reason, requires at least six dots and at least two direction changes, and warns you when the shape you just drew is a sequential run, a spiral or a recognisable letter. None of that repairs the observation problem, which is a property of drawing on glass in front of people rather than of the grid. It does mean that a pattern is only the weak choice when someone is watching, and a strong one when nobody is.

Which lock belongs on which door

Treat the phone and the private material inside it as two separate doors. On the phone, use Face ID with a long passcode behind it, and switch Stolen Device Protection on, which forces Face ID with no passcode fallback for sensitive actions when you are away from your usual places. That combination answers the stranger, the pickpocket and the person who filmed you unlocking it in a cafe. What it cannot answer is the person who already knows the passcode, or the moment you hand the unlocked phone to somebody to show them a photo and they keep scrolling. For that you need a lock that does not open just because the phone did.

That is the second door, and it is where a pattern earns its place. In Vaultaire, the pattern is not checked against a stored copy, because there is no stored copy to check against. The dots you draw are serialised and run through PBKDF2 with SHA-512 at 600,000 iterations, against a device bound salt held in the iOS keychain, and the result is the AES-256 key that decrypts the files. Getting the pattern wrong does not produce a rejection message from a server, it produces a key that does not open anything. There is no account, no password reset and no copy of the vault anywhere else, which is the same reason a recovery phrase is issued during setup and worth storing offline. Our explainer on what AES-256 encryption actually protects covers the cipher side, and our audit of vault app security claims covers how to check whether any given app is doing this or merely hiding a folder. Vaultaire is free for up to 5 vaults.

Related guides

• How to lock apps with Face ID on iPhone
• Forgot your photo vault password
• Can the hidden album Face ID lock be bypassed
• What AES-256 encryption actually protects

Frequently Asked Questions

Can someone really work out my pattern from smudges on the screen?

Yes, under the right conditions. The research that named the smudge attack photographed screens with controlled lighting and camera angles and recovered the full pattern in 68 percent of tests, with part of it visible in 92 percent. Ordinary handling smears the glass and makes it harder, and cleaning the screen removes it entirely, but the attack is real and it applies only to patterns. A PIN keypad leaves marks that reveal which digits you use without revealing the order.

Is Face ID safer than a passcode on iPhone?

They are not alternatives. Face ID is a fast path to the same passcode, and the passcode remains the underlying credential, which is why iOS asks for it after a restart, after 48 hours without an unlock, and after five failed face matches. Face ID is much better against observation, since there is nothing to watch. The passcode is better against the case where someone can point the phone at you. Use both, and make the passcode long.

Does a separate vault pattern help if someone already knows my iPhone passcode?

That is the main thing it is for. A person who knows your passcode gets the whole phone: Photos, Messages, the hidden album, iCloud on the web. A vault with its own credential is the only part that does not open with the rest, provided you never draw the pattern in front of them and never reuse the passcode digits as its shape. Choose something you have not typed in front of that person, because familiarity is the real attack here.

What happens if I forget the pattern?

In an app where the pattern derives the encryption key, nothing can recover the files except the pattern itself or the recovery phrase issued when you set it up. That is a direct consequence of the design: no server holds a copy, so no support process can reset it. Store the phrase on paper, away from the phone. Our guide on forgotten photo vault passwords, linked below, goes through the options that remain and which recovery claims to distrust.