Someone has seen your iPhone passcode

Change the code, expire the old one and check Face ID and your Apple Account for anything you did not set up.

Maybe a friend watched you type it at dinner, or a coworker stood behind you in the elevator. A passcode opens more than the Lock Screen. It also opens your Hidden album, your Recently Deleted photos and notes locked with the device passcode. It can also approve changes to your Apple Account.

Change the code and end the old one

1. Open Settings and tap Face ID & Passcode. Enter your current code.
2. Tap Change Passcode.
3. Tap Passcode Options if you want something stronger than six digits. Apple rates Custom Alphanumeric Code and Custom Numeric Code as the most secure choices.
4. Go back to the same screen and tap Expire Previous Passcode Now.

The fourth step is easy to skip. In iOS 17 and later, the old code keeps working for 72 hours as a fallback for people who forget a new one. Anyone who knows your old code could use it during that window to set a new passcode, if they have the phone.

With Stolen Device Protection on, you may need to wait an hour if you are away from a familiar place when you change the code.

Check what they could have added

Someone with your unlocked phone has time to set up a way back in, so look at each of these:

• Face ID. In Settings, under Face ID & Passcode, check whether an alternate appearance has been set up. If you are unsure, tap Reset Face ID and set it up again with only your face.
• Devices. Go to Settings, tap your name and look through the device list. Remove anything you do not recognize.
• Trusted numbers and email. Sign in to your Apple Account page and review the contact details and trusted devices.
• Apps. Scan for apps you do not remember installing.
• Profiles. Look in Settings under General, then VPN & Device Management. A personal phone usually shows nothing there.

iPhone with iOS 16 or later also has Safety Check, in Settings under Privacy & Security. It walks you through people, apps and devices in one place.

Change the passwords the code could unlock

If the person may have seen saved passwords, or had time to use the phone, change your Apple Account password and the passwords for your email and bank. Saved passwords open with Face ID or the passcode unless Stolen Device Protection requires a biometric check.

Reduce the next risk

Shield the screen when you type the code, and use Face ID in public where you can. Turn on Stolen Device Protection in Settings under Face ID & Passcode. Choose Always under Require Security Delay if you want the protections at home too.

For photos, the passcode is still a single key to the phone and the Hidden album. Apps with their own secret add a second lock, and our guide to locking photos sets out the options.

If the person who knows your code is a partner and you feel watched or afraid, slow down before changing anything and read this page on monitoring. A sudden lockout can raise the risk in some relationships.