How many wrong passcode attempts before a phone locks?

An iPhone lets you make 10 wrong passcode attempts. The first 4 cost nothing, then the waits grow from 1 minute to 8 hours, and after the 10th the phone is locked until you erase it, either from the lock screen or with a Mac or PC. It only wipes itself after 10 if you have turned on the Erase Data setting. An Android phone on Android 16 QPR2 or later, which includes Android 17, gives you 5 free guesses, then waits that climb from 1 minute to 9 years, and stops accepting guesses after the 20th. Older Android phones only had to meet a much looser minimum of up to 1800 guesses over 5 years. The "10 attempts" answer you see everywhere is the iPhone rule, and it was never the Android one.

Both schedules side by side

The table lines up the official schedules, wrong attempt by wrong attempt: Apple's from its Platform Security guide, Google's from the Android Open Source Project documentation, and Samsung's own stricter policy for Galaxy phones that ship with One UI 9. Each cell is the wait imposed after that wrong attempt, before you can try again.

Here is the same thing as a running total: the most wrong guesses someone could make by each point in time, starting from a phone with no failures. Google publishes these figures for Android. The iPhone and Samsung rows are worked out from their published waits, counted the same way.

Why everyone says "10 attempts"

Ten is a real number, but it belongs to Apple. It is where the iPhone schedule ends, it is the threshold for the Erase Data setting, and it is also the number of password attempts a Mac allows at its login window. Android had no single published equivalent, so 10 became the answer people repeat for every phone.

Android's old figure was never 10. The compatibility rules that every Android phone has to meet set a floor, not a fixed schedule. Google describes a phone meeting the bare minimum before Android 16 QPR2 as allowing up to 10 guesses in the first minute, 20 in 6 minutes, 50 in 25 minutes, 110 in 24 hours and 1800 in 5 years. That is where the "1800 to 20" headlines of June 2026 come from. A maker could always be stricter than the floor, which is why people with older Android phones report such different limits.

The reason is that people do not choose PINs at random, so an attacker who tries the most common ones first does far better than the arithmetic suggests. The AOSP page cites a study, "This PIN Can Be Easily Guessed", which found a 16.2% success rate for guessing real-world PINs after 100 guesses, and 35.5% for patterns. Under the old floor, 100 guesses fit inside a single day. Under the new schedule you never get there.

Locked or erased: what actually happens

On an iPhone with default settings, nothing is deleted when you reach 10. The screen says the iPhone is unavailable and stops accepting the passcode. Getting back in, though, means erasing it anyway. From iOS 15.2 onward, a Forgot Passcode? button (Erase iPhone on iOS 15.2 and 16) appears on that screen if the phone has Find My turned on and a cellular or Wi-Fi connection; you enter your Apple Account password and the phone erases itself. Without a connection, Apple's route is to put the phone into recovery mode and restore it from a Mac or Windows PC, a process Apple says erases the data on the iPhone. Either way, what you get back depends on your last backup.

The Erase Data option, under Face ID or Touch ID and Passcode in Settings, removes all content and settings straight after 10 consecutive wrong attempts. Apple adds a detail most guides leave out: repeating the same wrong passcode does not count toward the limit, so a child tapping 1111 over and over does not burn through it. An employer's device management can switch this on with a lower threshold than 10.

Android's documentation describes no automatic wipe. After the 20th wrong guess the phone simply refuses all further guesses, and on Android 17 the lock screen shows a short link, by default g.co/android/unlock, pointing to recovery options on another device. Samsung is blunter: on the 13th failed attempt a One UI 9 phone is permanently locked and can only be used again after a factory reset, and you then need both your Samsung and Google account details to clear Factory Reset Protection. That last step is the same check that protects a stolen phone, and it is why wiping a phone properly before you sell it includes signing out of those accounts first.

What the counter does and does not count

Repeated identical guesses are increasingly forgiven. Besides Apple's rule for Erase Data, Android 16 QPR2 supports duplicate guess detection, so entering the same wrong PIN again is not counted, although only on phones with the right security hardware and settings. Samsung calls its version smart counting: the same wrong password twice in a row is one failure, not two.

Turning an iPhone off does not reset anything. Apple says the waits are enforced by the Secure Enclave, the separate security chip, and that if the device restarts during a delay, the delay still applies with the timer starting over for the current period. If your battery no longer lasts the day, keep a locked phone on the charger: a phone that dies mid-wait starts that wait again.

Face and fingerprint unlock sit on top of all this. They are a convenience layer over the passcode, which is still the credential these limits protect. If you rely on your face so much that the passcode is fading from memory, the caveats of face and fingerprint unlock are worth reading.

The limits are also why a short passcode is less weak than it looks. Apple calibrates each attempt to take about 80 milliseconds, and the counter stops a thief long before that matters. The passcode still has to be one nobody can guess from your birthday, and what makes a password or PIN strong explains how to pick one.

Where these numbers stop applying

The Android schedule only applies to phones running Android 16 QPR2 or later with the updated security components. Google lets manufacturers add a software rate limiter where the security hardware cannot be updated, and older versions only had to meet the old minimum, so how long your phone gets updates decides whether you ever receive it. Samsung adds a catch of its own: a phone updated to One UI 9 keeps its previous settings, and the stricter 13 attempt policy only takes effect after a full factory reset, while phones that ship with One UI 9 have it from the start. Google also says its schedule may change in future versions.

Macs work differently from phones. A Mac allows 10 password attempts at the login window after starting up, then 10 more after restarting into recoveryOS, then 10 more through the FileVault recovery method you set up, such as a recovery key or iCloud. When those run out, Apple says the data on the drive becomes unrecoverable. The limits are not enforced once you have logged in, and come back after a restart. An Apple Watch follows the iPhone schedule, but after 10 it has to be reconnected to its iPhone.

These figures come from Apple, Google and Samsung documentation as published in October 2026.

Before you get anywhere near the limit

1. Stop at the first wait. On an iPhone the 4th wrong attempt already costs a minute, and on Android the 5th.
2. Know that the end point is an erase. On both platforms, a phone you cannot unlock comes back only as an empty phone, so your data is only as safe as your last working backup.
3. Check that you can sign in to your account without the phone. Erasing an iPhone needs your Apple Account password, and clearing a Galaxy needs your Samsung and Google passwords. Setting up account recovery in advance covers both.
4. Back up your authenticator codes. A wiped phone takes its authenticator app with it, which is why an authenticator setup with working backups matters before a lockout, not after.
5. Think twice before turning on Erase Data with children around. Repeats are forgiven, but 10 different wrong guesses wipe the phone.