In recent years, Apple had switched from 4-digit PINs to 6 digits, while implementing blacklists of insecure PIN codes. How do these measures affect security, how much more security do six-digit PINs deliver compared to four-digit PINs, and do blacklists actually work? Let’s try to find out.

The role of PIN codes/passcodes in mobile forensics

Simply put, a PIN code or passcode is the key to the content of an iOS device. While a passcode can be composed of an arbitrary number of alphanumeric characters, PINs are digit-only, fixed length passcodes. In this article we’ll discuss the security of PIN codes.

While some activities can be performed with a biometrically unlocked device (Face ID or Touch ID), a lot of activities require the use of a PIN code. Without a PIN code, most acquisition methods (except manual analysis) may not be available. A PIN code is needed to pair the device to the computer, which is a required pre-requisite to both the advanced logical and low-level extraction methods. The PIN is required even for extracting devices that are vulnerable to checkm8 as without the PIN most user data on the device will remain encrypted. The following table summarizes the differences between unlocking the device with biometrics (Touch ID/Face ID) and PIN code.

* While you can unlock the device with biometrics and connect a USB accessory, pairing the device to a computer would still require a PIN.

Risk assessment

In the context of forensic investigations, the ability to recover PIN codes can be critical to gaining access to evidence stored on a device. However, with the Erase Data option turned on, there is a risk that all content and settings on the device will be permanently deleted after 10 (or less) consecutive incorrect attempts to enter the passcode. According to Apple, “If the Erase Data option is turned on (in Settings > Touch ID & Passcode), after 10 consecutive incorrect attempts to enter the passcode, all content and settings are removed from storage. Consecutive attempts of the same incorrect passcode don’t count toward the limit. This setting is also available as an administrative policy through a mobile device management (MDM) solution that supports this feature and through Microsoft Exchange ActiveSync, and can be set to a lower threshold.”

The risk of recovering PIN codes with the Erase Data option turned on is high, and experts must carefully balance the need for access to evidence with the potential risk of permanently deleting important information. Therefore, if you are considering attempting to recover a PIN code, be careful not to exceed the allowable number of incorrect attempts. This means you must have a solid understanding of the potential consequences of exceeding the limit, and must exercise reasonable caution when attempting to recover the passcode.

Note that the Erase Data option can be set to a lower threshold through MDM or Microsoft Exchange ActiveSync, which could make it even more challenging to attack a PIN code without losing access to the data.

PIN throttling

Apple has a comprehensive article on Passcodes and passwords in which the company explains how escalating time delays discourage brute-force attacks. Quote:

Weak PIN codes

Some PIN codes are weaker than others. According to PIN number analysis (datagenetics.com), these twenty PIN codes represent 26.83% of real-world PIN codes in use:

Assuming that you know nothing about the suspect, the best attack strategy would be to try these most popular PINs first. In fact, you may try an even larger list of common PIN codes such as those published on github. Besides Apple’s 4-digit and 6-digit blocklists, the authors also created data-driven blocklists that are significantly (10x) smaller (27/29 PINs) and (10x) larger (2740/291,000 PINs) than the iOS 4/6-digit blocklists. Some of those lists are made available by the authors; please visit This PIN Can Be Easily Guessed for more information and download links.

Social engineering

The most common PIN codes work great if you know nothing about the suspect. However, if you do have some information about them, the best attack strategy would be to try a small list of the most popular PINs first followed by the list of PINs that might be significant for the suspect. Examples of such PINs include:

• Memorable years (four digits): dates of births of the suspect and their family members; years of other significant dates. Multiple studies suggest that PINs starting with 1900 are more likelyy to occur, followed by PINs starting with 2000.
• Memorable dates in MMYY, DDMM, MMYYYY and other representations (four or six digits): this also includes significant dates in various common representations.
• Parts of telephone numbers (first four digits, last four digits) of family members and frequent contacts.

Creative or too creative?

It is known that some patterns are more common than others for various reasons. For example, 696969 is one of the most common six-digit PINs, or 159753 (a “X” mark over the numeric keypad). There can be many different reasons making certain PINs more likely than the rest, and there are various studies such as PIN number analysis (datagenetics.com), [2003.04868] This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs (arxiv.org) or (PDF) On the Security of Smartphone Unlock PINs (researchgate.net) analyzing the patterns in many details. These studies are interesting reading, but in the end common PIN codes have all been published in the lists of weak PIN codes. There is no need to be too creative when attacking an iPhone PIN code. We recommend the following courses of action.

Cold attack (nothing is known about the owner)

1. List of common PIN codes

Smart attack/social engineering (some information is known about the owner and/or their surrounding)

1. Short list of common PIN codes
2. PIN codes composed of memorable years, memorable dates, and parts of telephone numbers
3. Long list of common PIN codes

Blacklists

A blacklist is a list of unacceptable PINs. Blacklists can be blocking (an unacceptable PIN will be rejected) and non-blocking (the user will be warned, but an unacceptable PIN can still be used). According to a study conducted by Philipp Markert, Daniel V. Bailey, Maximilian Golla, Markus Dürmuth, and Adam J. Aviv back in 2020, iOS maintains non-blocking blacklists for for 4-digits (274 PINs) as well as 6-digits (2910 PINs). The authors concluded that these “relatively small blocklists in use today by iOS offer little or no benefit against a throttled guessing attack“.

On the other hand, these built-in blocklists represent the most commonly used PIN codes, and they are non-blocking, which means that trying PINs from these blocklists may increase probability of a successful unlock. Note that iOS blocklists are already included to many lists of the most common PINs.

Additional information

Interested in smartphone PIN security? We recommend the following articles:

• PIN number analysis (datagenetics.com)
• [2003.04868] This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs (arxiv.org)
• This PIN Can Be Easily Guessed (this-pin-can-be-easily-guessed.github.io)
• (PDF) On the Security of Smartphone Unlock PINs (researchgate.net)
• An analysis of chosen alarm code pin numbers & their weakness against a modified brute force attack (ecu.edu.au)
• Avian’s Blog: Analyzing PIN numbers (tablix.org)

Analysis of Android lock patterns:

• GitHub – delight-im/AndroidPatternLock: List of all combinations for the Android pattern lock

Just for fun:

• The Meanings of Numbers in Pin Code Analysis – Falcı Bacı Diyor ki (falcibacidiyorki.com)