Pattern vs passcode vs Face ID

How the three compare on guessing, watching over your shoulder and coercion, and why a pattern in an app is not as strong as your iPhone passcode alone.

Against guessing

iPhone passcode. This is the strongest here. Apple says the passcode is tied to the device, so guesses must happen on that phone. Each takes time, and the Secure Enclave enforces escalating delays.

Pattern in an app. An app cannot use those hardware limits in the same way. Backroom slows each guess with PBKDF2, and its salt sits in the Keychain. Someone with a full extraction of the phone could try guesses offline, which a passcode’s design prevents. This is why you should draw a long pattern with many turns. Check one with the pattern strength tool.

Face ID. You cannot guess it, in the usual sense. Its fallback is your passcode, and Apple requires the passcode after a restart and in other situations.

Against someone watching

Passcodes get learned by a glance. Patterns are even easier to see, which is why Backroom offers Hide the line while drawing. Face ID shows nothing to watch.

Against someone close to you

Here the ranking flips. A partner who knows your passcode opens Hidden, locked apps and notes on device passcode. They do not get a separate pattern. A second vault under another pattern gives you another option, within limits: a forensic exam could estimate how much data the app stores.

Against pressure

None of these protects you from someone forcing you. Face ID works when a phone is held to your face, unless attention is required and you look away. Apple requires the passcode after five failed Face ID attempts. For legal aspects, read border searches and protests.

What to use

Use a long passcode with Face ID for the phone, and add a separate secret for the small set of things that need it.