Lock state, Lockdown Mode and GrapheneOS: what each changes

What the sources say

What a document, a report, an agency publication or a provision says, quoted as it is worded.

• Apple’s Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.

  Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple

  “Complete Protection—The class key is protected with a key derived from the user passcode or password and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID , Face ID , or Touch ID .”

  Read it at support.apple.comquote checked 2026-10-01

• Apple’s Platform Security Guide describes a default class for all third-party app data not otherwise assigned to a Data Protection class.

  Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple

  “Protected Until First User Authentication—This class behaves in the same way as Complete Protection, except that the decrypted class key isn’t removed from memory when the device is locked or the user logged out.—This is the default class for all third-party app data not otherwise assigned to a Data Protection class.”

  Read it at support.apple.comquote checked 2026-10-04

• Android's file-based encryption documentation states that Credential Encrypted (CE) storage, which is the default storage location, is only available after the user has unlocked the device.

  Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08

  “Credential Encrypted (CE) storage, which is the default storage location and only available after the user has unlocked the device.”

  Read it at source.android.comquote checked 2026-09-08

• Apple’s “About Lockdown Mode” page says that when Lockdown Mode is enabled some apps and features will function differently, including “Device connections: to connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked.”

  Apple, "About Lockdown Mode" (support.apple.com/en-gb/105120), as fetched 2026-09-08

  “When Lockdown Mode is enabled, some apps and features will function differently, including:—Device connections: to connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked.”

  Read it at support.apple.comquote checked 2026-10-01

• Apple’s “About Lockdown Mode” page says “Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people will never be targeted by attacks of this nature.”

  Apple, "About Lockdown Mode" (support.apple.com/en-gb/105120), as fetched 2026-10-14

  “Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people will never be targeted by attacks of this nature.”

  Read it at support.apple.comquote checked 2026-10-14

• GrapheneOS’s Features page says it provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest; that the timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off; and that the feature doesn't apply when the device is in “Before First Unlock” state.

  GrapheneOS, "Features" (grapheneos.org/features), "Auto reboot" paragraph, as fetched 2026-10-01

  “GrapheneOS provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest.—The timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off.—This feature doesn't apply when the device is in "Before First Unlock" state”

  Read it at grapheneos.orgquote checked 2026-10-01

• GrapheneOS’s Features page says it provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device (along with any installed eSIMs) once entered anywhere where the device credentials are requested (on the lockscreen, along with any such prompt in the OS).

  GrapheneOS, "Features" (grapheneos.org/features), as fetched 2026-09-08

  “GrapheneOS provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device (along with any installed eSIMs) once entered anywhere where the device credentials are requested (on the lockscreen, along with any such prompt in the OS).”

  Read it at grapheneos.orgquote checked 2026-09-08

• GrapheneOS’s Features page says its USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted, and that the default is Charging-only when locked, which significantly reduces attack surface when the device is locked.

  GrapheneOS, "Features" (grapheneos.org/features), "USB-C port and pogo pins control" paragraph, as fetched 2026-10-01

  “Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.—The default is Charging-only when locked , which significantly reduces attack surface when the device is locked.”

  Read it at grapheneos.orgquote checked 2026-10-01

• GrapheneOS’s Features page says that its auto-reboot feature reboots locked devices after a set period of time to put data at rest; that a countdown timer is started each time the device is locked, and the device will reboot if a successful unlock doesn't occur before the timer reaches zero; that unlocking any profile cancels the timer, not just the Owner profile; that the feature doesn't apply when the device is in “Before First Unlock” state, meaning that it will not lead to the device continuously rebooting, as data is already at rest; and that the feature is implemented in the init process, preventing it from being bypassed through system process crashes since an init crash causes a kernel panic which leads to a reboot.

  GrapheneOS, "Features" (grapheneos.org/features), "Auto reboot" paragraph, as fetched 2026-10-14

  “GrapheneOS provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest. A countdown timer is started each time the device is locked, and the device will reboot if a successful unlock doesn't occur before the timer reaches zero. Unlocking any profile cancels the timer, not just the Owner profile. The timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off. This feature doesn't apply when the device is in "Before First Unlock" state, meaning that it will not lead to the device continuously rebooting, as data is already at rest. The feature is implemented in the init process, preventing it from being bypassed through system process crashes since an init crash causes a kernel panic which leads to a reboot.”

  Read it at grapheneos.orgquote checked 2026-10-14

• Google’s Advanced Protection help page lists, among the protections offered by Advanced Protection, Inactivity Reboot: “Automatically reboot your phone if it remains locked for 72 hours. The process of rebooting will make user data unreadable until a fresh unlock takes place.”

  Google, Android Help, "Improve device security with Advanced Protection for Android" (support.google.com/android/answer/16339980), as fetched 2026-10-14

  “Review protections offered by Advanced Protection.—Inactivity Reboot: Automatically reboot your phone if it remains locked for 72 hours. The process of rebooting will make user data unreadable until a fresh unlock takes place.”

  Read it at support.google.comquote checked 2026-10-14

• Magnet Forensics’ blog said, on 13 Nov 2024, in a post titled “Understanding the security impacts of iOS 18’s inactivity reboot”, that once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot, and that while the timer is 72 hours (3 days) in iOS 18.1, it was originally for 7 days in iOS 18.0.

  Magnet Forensics blog, "Understanding the security impacts of iOS 18's inactivity reboot", 13 Nov 2024

  “This reboot ensures that data that is at rest for longer than three days gets rebooted so that it gets returned to its most secure state.—The inactivity reboot trigger is tied to the lock state of the device, not to network settings, charging status, nor data functions. This means that once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot. There are no prompts or warnings displayed on the device to cancel or interrupt this process. It should be noted that while the timer is 72 hours (3 days) in iOS 18.1, it was originally for 7 days in iOS 18.0.”

  Read it at magnetforensics.comquote checked 2026-10-02

• GrapheneOS’s FAQ says that it enables support for ending secondary user profile sessions after logging into them; that this fully purges the encryption keys and puts the profiles back at rest; and that this can't be done for the owner profile without rebooting due to it encrypting the sensitive system-wide operating system data.

  GrapheneOS, "Frequently Asked Questions" (grapheneos.org/faq), "How is disk encryption implemented?" paragraph, as fetched 2026-10-14

  “GrapheneOS enables support for ending secondary user profile sessions after logging into them.—This fully purges the encryption keys and puts the profiles back at rest. This can't be done for the owner profile without rebooting due to it encrypting the sensitive system-wide operating system data.”

  Read it at grapheneos.orgquote checked 2026-10-14

• GrapheneOS’s Features page, in its “USB-C port and pogo pins control” section, says “Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.” and “The feature has five modes”, and lists them as Off; Charging-only; Charging-only when locked; Charging-only when locked, except before first unlock; and On.

  GrapheneOS, "Features" (grapheneos.org/features), "USB-C port and pogo pins control" paragraph, as fetched 2026-10-14

  “Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.—The feature has five modes: Off Charging-only Charging-only when locked Charging-only when locked, except before first unlock On”

  Read it at grapheneos.orgquote checked 2026-10-14

• GrapheneOS’s Features page, in its “USB-C port and pogo pins control” section, says “Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.”, that the default is Charging-only when locked, which significantly reduces attack surface when the device is locked, and that after locking, it blocks any new USB connections immediately through either USB-C and pogo pins at both the hardware level via configuring the USB controller and also at the OS level in the kernel to provide a second layer of defense.

  GrapheneOS, "Features" (grapheneos.org/features), "USB-C port and pogo pins control" paragraph, as fetched 2026-10-14

  “Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.—The default is Charging-only when locked , which significantly reduces attack surface when the device is locked. After locking, it blocks any new USB connections immediately through either USB-C and pogo pins at both the hardware level via configuring the USB controller and also at the OS level in the kernel to provide a second layer of defense.”

  Read it at grapheneos.orgquote checked 2026-10-14

• Google’s Advanced Protection help page lists, among the protections offered by Advanced Protection, USB Protection: “Secure your Android device with USB Protection. When your screen is locked, it protects your device from unauthorized access through a USB connection.”

  Google, Android Help, "Improve device security with Advanced Protection for Android" (support.google.com/android/answer/16339980), as fetched 2026-10-14

  “Review protections offered by Advanced Protection.—USB Protection: Secure your Android device with USB Protection. When your screen is locked, it protects your device from unauthorized access through a USB connection.”

  Read it at support.google.comquote checked 2026-10-14

• GrapheneOS’s FAQ says “A secure internal timer is used to implement hardware-based delays for each attempt at key derivation. Only a total of 20 attempts is permitted.” and that its “Standard delays for encryption key derivation enforced by the secure element” include the entry “20 No more attempts allowed”.

  GrapheneOS, "Frequently Asked Questions" (grapheneos.org/faq), "How is disk encryption implemented?" paragraph, as fetched 2026-10-14

  “The Weaver token is stored alongside a Weaver key derived by the OS from the password token. In order to retrieve the Weaver token, the secure element requires the correct Weaver key. A secure internal timer is used to implement hardware-based delays for each attempt at key derivation. Only a total of 20 attempts is permitted.—Standard delays for encryption key derivation enforced by the secure element:—19 9 years 20 No more attempts allowed”

  Read it at grapheneos.orgquote checked 2026-10-14

• Google’s theft-protection help page says “These features aren’t supported on Android Go devices, tablets, and wearables. Support may also vary based on your smartphone device model.”, and that “If Failed Authentication Lock is on, your device will automatically lock when authentication attempts fail repeatedly.”

  Google, Android Help, "Protect your personal data against theft" (support.google.com/android/answer/15146908), as fetched 2026-10-14

  “These features aren’t supported on Android Go devices, tablets, and wearables. Support may also vary based on your smartphone device model.—If Failed Authentication Lock is on, your device will automatically lock when authentication attempts fail repeatedly.”

  Read it at support.google.comquote checked 2026-10-14

• Apple’s Platform Security Guide says “If the Erase Data option is turned on for iPad, iPhone, or Apple Vision Pro”, “after 10 consecutive incorrect attempts to enter the passcode, all content and settings are removed from storage.” It also says “Consecutive attempts of the same incorrect passcode don’t count toward the limit”, and that the setting is also available as an administrative policy through a device management service that supports this feature and through Microsoft Exchange ActiveSync, and “can be set to a lower threshold”.

  Apple Platform Security Guide — "Passcodes and passwords", published 19 Dec 2024, Apple

  “If the Erase Data option is turned on for iPad, iPhone, or Apple Vision Pro—after 10 consecutive incorrect attempts to enter the passcode, all content and settings are removed from storage. Consecutive attempts of the same incorrect passcode don’t count toward the limit. This setting is also available as an administrative policy through a device management service that supports this feature and through Microsoft Exchange ActiveSync, and can be set to a lower threshold.”

  Read it at support.apple.comquote checked 2026-10-14

• Apple’s Platform Security Guide, in its “Passcodes and passwords” article, says “The delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period.”

  Apple Platform Security Guide — "Passcodes and passwords", published 19 Dec 2024, Apple

  “The delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period.”

  Read it at support.apple.comquote checked 2026-10-14

• GrapheneOS’s FAQ says “8th generation and later Pixels also have support for the incredibly powerful hardware memory tagging security feature as part of moving to new ARMv9 CPU cores. GrapheneOS uses hardware memory tagging by default to protect the base OS and known compatible user installed apps against exploitation, with the option to use it for all apps and opt-out on a case-by-case basis for the few incompatible with it.”

  GrapheneOS, “Frequently Asked Questions” page (grapheneos.org/faq), a paragraph under its heading “Which devices are recommended?”, as fetched 2026-10-14

  “8th generation and later Pixels also have support for the incredibly powerful hardware memory tagging security feature as part of moving to new ARMv9 CPU cores. GrapheneOS uses hardware memory tagging by default to protect the base OS and known compatible user installed apps against exploitation, with the option to use it for all apps and opt-out on a case-by-case basis for the few incompatible with it.”

  Read it at grapheneos.orgquote checked 2026-10-14

• Google’s Advanced Protection help page lists, among the protections offered by Advanced Protection, Memory Tagging Extension (MTE): “For supported apps, MTE will help prevent apps from corrupting memory. When MTE is on, you may experience slower device performance.”

  Google, Android Help, "Improve device security with Advanced Protection for Android" (support.google.com/android/answer/16339980), as fetched 2026-10-14

  “Review protections offered by Advanced Protection.—Memory Tagging Extension (MTE) : For supported apps, MTE will help prevent apps from corrupting memory. When MTE is on, you may experience slower device performance.”

  Read it at support.google.comquote checked 2026-10-14

• GrapheneOS’s Features page says “GrapheneOS has a compatibility layer providing the option to install and use the official releases of Google Play in the standard app sandbox. Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access.”

  GrapheneOS, "Features" (grapheneos.org/features), "Sandboxed Google Play" paragraph, as fetched 2026-10-14

  “GrapheneOS has a compatibility layer providing the option to install and use the official releases of Google Play in the standard app sandbox. Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access.”

  Read it at grapheneos.orgquote checked 2026-10-14

• GrapheneOS’s Features page says, of its duress PIN/Password, that the wipe does not require a reboot and cannot be interrupted, and that if the duress PIN/Password is the same as the actual unlock method, the actual unlock method always takes precedence, and therefore no wipe will occur.

  GrapheneOS, "Features" (grapheneos.org/features), "Duress PIN/Password" paragraph, as fetched 2026-10-14

  “The wipe does not require a reboot and cannot be interrupted.—Duress PIN will also wipe the device when entered as the two-factor fingerprint unlock PIN but not currently when entered as the SIM PIN. Note that if the duress PIN/Password is the same as the actual unlock method, the actual unlock method always takes precedence, and therefore no wipe will occur.”

  Read it at grapheneos.orgquote checked 2026-10-14

• Osservatorio Nessuno’s analysis “A deep dive into Cellebrite: Android support as of February 2025”, published 16 Mar 2025, said, in the paragraph under its figure captioned “Support matrix, older Pixel devices up to the 5/5a.”, that “Pixel devices remain quite a solid choice if kept updated”; that “While it seems that for the standard Google ROM there are working exploits available to perform the FFS extraction in AFU state, on the contrary GrapheneOS additional hardening and protections are effective, and have been so since 2022.”; and that “Brute force is generally not available, because the user credentials are stored in the secure element, and thus cannot be extracted and active attempts are heavily throttled.”

  Osservatorio Nessuno, "A deep dive into Cellebrite: Android support as of February 2025", 16 Mar 2025

  “Support matrix, older Pixel devices up to the 5/5a.—Pixel devices remain quite a solid choice if kept updated. While it seems that for the standard Google ROM there are working exploits available to perform the FFS extraction in AFU state, on the contrary GrapheneOS additional hardening and protections are effective, and have been so since 2022. Brute force is generally not available, because the user credentials are stored in the secure element, and thus cannot be extracted and active attempts are heavily throttled.”

  Read it at osservatorionessuno.orgquote checked 2026-10-14

• Apple’s Legal Process Guidelines for government and law enforcement within the United States state that for all devices running iOS 8.0 and later versions, Apple is unable to perform an iOS device data extraction as the data typically sought by law enforcement is encrypted, and Apple does not possess the encryption key.

  Apple, "Legal Process Guidelines — Government & Law Enforcement within the United States", published October 2025, Apple

  “For all devices running iOS 8.0 and later versions, Apple is unable to perform an iOS device data extraction as the data typically sought by law enforcement is encrypted, and Apple does not possess the encryption key.”

  Read it at apple.comquote checked 2026-09-08