An algorithm cracked 87.5% of “complex” Android pattern locks on the first try, using phone camera footage from 8 feet away.
That cool-looking swipe pattern is the weakest option on this list. A 3x3 grid technically has 389,112 combinations, but the average person connects just 5 dots (about 7,000 combos) and most use only 4 (1,624 combos, fewer than a 4-digit PIN). 44% of patterns start in the top-left corner, 77% start in a corner, and about 10% of people just draw the first letter of their name.
The biometrics tell a different story. Touch ID’s false acceptance rate (odds a stranger’s finger unlocks your phone) is 1 in 50,000. Face ID jumped to 1 in 1,000,000 using 30,000 infrared dots to 3D-map your face, though twins and kids under 13 can sometimes fool it. Optic ID matches that 1 in 1,000,000 rate, but the biometric underneath is far richer: your iris has over 200 measurable features versus 40 to 60 for a fingerprint, patterns form randomly in the womb, and even identical twins have completely different irises.
PINs look decent on paper (10,000 combinations for 4 digits) but collapse in practice. In a 3.4 million sample, 10.7% of people chose 1234. Try just 61 combinations and you’d crack a third of all PINs. A study found 6-digit PINs provide “little to no increase in security” over 4-digit ones, because people just pick 123456 or a birth year.
Random stranger picks up your phone? Face ID and Optic ID are 20x more secure than Touch ID and orders of magnitude ahead of most people’s PINs or patterns.
Honestly, which one provides better security?