Phone SeizedProtect yourselfPasscode strength and delay: what vendors document
Passcode strength and delay: what vendors document
What you must do, what you can refuse, and what they can do
Every claim below links to the source it comes from, with the wording quoted so you can check it yourself.
What the sources say
What a document, a report, an agency publication or a provision says, quoted as it is worded.
Apple’s Platform Security Guide says that on iPad, iPhone, Mac, and Apple Vision Pro, to further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode, password, or PIN (depending on the device and the state the device is in).
Apple Platform Security Guide — "Passcodes and passwords", published 19 Dec 2024, Apple
“On iPad, iPhone, Mac, and Apple Vision Pro , to further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode, password, or PIN (depending on the device and the state the device is in), as shown in the table below.”
Read it at support.apple.comquote checked 2026-09-08
Apple states it would take more than five and one-half years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers.
Apple Platform Security Guide — "Passcodes and passwords", published 19 Dec 2024, Apple
“In fact, it would take more than five and one-half years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers.”
Read it at support.apple.comquote checked 2026-09-08
GrapheneOS’s Features page says of one feature that it allows users to make use of diceware passwords if they don't want to depend on the security of the secure element which provides very aggressive throttling and offers a high level of security even for a random 6 digit PIN.
GrapheneOS, "Features" (grapheneos.org/features), as fetched 2026-09-08
“This feature allows users to make use of diceware passwords if they don't want to depend on the security of the secure element which provides very aggressive throttling and offers a high level of security even for a random 6 digit PIN.”
Read it at grapheneos.orgquote checked 2026-09-08
Android’s file-based encryption documentation says that all devices launching with Android 10 and higher are required to use file-based encryption.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08
“All devices launching with Android 10 and higher are required to use file-based encryption.”
Read it at source.android.comquote checked 2026-09-08
Apple’s Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Complete Protection—The class key is protected with a key derived from the user passcode or password and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID , Face ID , or Touch ID .”
Read it at support.apple.comquote checked 2026-10-01
In a blog post of 13 Nov 2024 titled “Understanding the security impacts of iOS 18’s inactivity reboot”, Magnet Forensics said that once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot; it also said that the timer is 72 hours (3 days) in iOS 18.1 and was originally 7 days in iOS 18.0, and that the reboot ensures that data that is at rest for longer than three days gets rebooted so that it gets returned to its most secure state.
Magnet Forensics blog, "Understanding the security impacts of iOS 18's inactivity reboot", 13 Nov 2024
“This reboot ensures that data that is at rest for longer than three days gets rebooted so that it gets returned to its most secure state.—The inactivity reboot trigger is tied to the lock state of the device, not to network settings, charging status, nor data functions. This means that once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot. There are no prompts or warnings displayed on the device to cancel or interrupt this process. It should be noted that while the timer is 72 hours (3 days) in iOS 18.1, it was originally for 7 days in iOS 18.0.”
Read it at magnetforensics.comquote checked 2026-10-02
AppleInsider reported on 18 Jul 2024 that an April 2024 document listing which iPhones Cellebrite can unlock had been leaked, that two documents were obtained from a Cellebrite customer, according to 404 Media, and that significant sections of the model/iOS matrix in the documents are listed as either “Coming Soon,” or “in Research.”
AppleInsider, "Cellebrite can't crack iPhones running iOS 17.4 or later", William Gallagher, 18 Jul 2024
“However, while its methods and tools have not been disclosed, an April 2024 document listing which iPhones it can unlock has been leaked. According to 404 Media—two documents were obtained from a Cellebrite customer and sent anonymously to the publication, with one covering iPhones, one for Android. The documents include a matrix listing all phone types, ranges of iOS updates, and how they can be unlocked. Significant sections of the model/iOS matrix are listed as either "Coming Soon," or "in Research."”
Read it at appleinsider.comquote checked 2026-10-02
Passcode strength and delay, in Apple's own words
Apple’s Platform Security Guide says two things on this. First, on delay: “On iPad, iPhone, Mac, and Apple Vision Pro, to further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode, password, or PIN (depending on the device and the state the device is in).” Second, on passcode length and character set: Apple states “it would take more than five and one-half years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers.” That figure is stated for a six-character alphanumeric passcode with lowercase letters and numbers; this page does not extend it to any other kind of passcode.
The same idea implemented differently: GrapheneOS and Android
GrapheneOS’s Features page says of one feature that it “allows users to make use of diceware passwords if they don’t want to depend on the security of the secure element which provides very aggressive throttling and offers a high level of security even for a random 6 digit PIN.” Separately, Android’s file-based encryption documentation says that “all devices launching with Android 10 and higher are required to use file-based encryption.” See What a full extraction contains for the Credential Encrypted and Device Encrypted storage locations.
What happens if a locked phone sits untouched
Apple’s Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device the decrypted class key is discarded, “rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.” See What a full extraction contains for the device states used on this site. Separately, Magnet Forensics’ blog post of 13 Nov 2024, “Understanding the security impacts of iOS 18’s inactivity reboot”, said “once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot”; it also said that the timer is 72 hours (3 days) in iOS 18.1 and was originally 7 days in iOS 18.0, and that the reboot ensures that data that is at rest for longer than three days gets rebooted so that it gets returned to its most secure state. Those are statements in a Magnet Forensics blog post, not Apple support-page statements.
What AppleInsider reported about a model/iOS matrix
AppleInsider reported on 18 Jul 2024 that an April 2024 document listing which iPhones Cellebrite can unlock had been leaked, that two documents were obtained from a Cellebrite customer, according to 404 Media, and that “significant sections of the model/iOS matrix” in the documents “are listed as either ‘Coming Soon,’ or ‘in Research.’” That is a news report of what the leaked documents were reported to list, not a statement by any vendor and not a guarantee about any other date.
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.