Choosing a Strong Screen Lock on Android (PIN, Pattern, Password)

Last year, I watched a friend unlock his phone at a bar. He used a simple "L" shape pattern. I wasn't even trying to snoop, but I saw it clearly from three feet away. This is called "shoulder surfing," and it's how most phones get breached in the real world. Your screen lock is the front door to your bank apps, your private photos, and your emails. If that door is weak, all the encryption in the world won't save you. I've switched between patterns, PINs, and passwords on my Pixels and Galaxies over the years, and I've learned that most of us choose convenience over actual safety without realizing how much we're giving up.

Why the lock matters

Your screen lock does more than just stop your kids from messing with your apps. On modern Android phones, your lock screen choice is actually the key that encrypts your entire storage. When your phone restarts, it needs that PIN or password to "unlock" the vault where your data lives. If someone steals your phone and restarts it, they can't get to your files without that code. But here is the annoying part: if your lock is weak, a thief can use automated software to "brute force" their way in. A 4-digit PIN only has 10,000 possible combinations. A computer can guess those in seconds if it bypasses the "too many attempts" throttle.

PIN length and entropy

Most of us use 4-digit PINs because they're fast. But 4 digits is the bare minimum and, honestly, it's pretty risky today. I switched to a 6-digit PIN a few years ago. By adding just two more numbers, you go from 10,000 combinations to 1 million. That's a massive jump in security for about half a second of extra typing. On Android 13 and 14, there's an option called "Enhanced PIN privacy" that turns off the animations when you tap the numbers, so nobody can see which buttons you're hitting. If you must use a PIN, make it at least 6 digits and avoid obvious stuff like 123456, your birth year, or digits that make a geometric shape on the keypad.

Pattern weaknesses

I'll be honest: I love patterns. They're fun and fast. But they are arguably the weakest choice you can make. Patterns leave "fingerprint smudges" on your screen. If I find your phone, I can often just tilt the screen under a light and see exactly where your finger traced the pattern. Research suggests that most people start their pattern in the top-left corner and use only 4 or 5 nodes. This makes them incredibly easy to guess. If you’re stuck on using a pattern, at least go into Settings > Security > Screen Lock and toggle off "Make pattern visible." This prevents the grid from showing the lines as you draw them, which helps against people watching over your shoulder.

Alphanumeric passwords

An alphanumeric password—using letters, numbers, and symbols—is the gold standard. It's what I use if I'm traveling or in high-risk environments. The "entropy" (a fancy word for randomness) of a 12-character password is astronomical compared to a PIN. However, typing a full password every time you want to check a text is miserable. I found that I ended up disabling my lock entirely because I got frustrated with a long password. This is where the trade-off happens. If a password is so long that it makes you use biometrics 100% of the time, that's okay—as long as the password itself is solid for when the phone reboots.

Samsung and Pixel options

Depending on your phone, the menus look a bit different. On my Pixel, it's under Settings > Security & privacy > Device unlock. On a Samsung running One UI 6, you'll find it under Settings > Lock screen and AOD > Screen lock type. Samsung has a cool feature called "Auto factory reset" that wipes the phone after 15 failed unlock attempts. I have mixed feelings about this. It's great for security, but I've heard horror stories of people's toddlers wiping their phones by accident. If you use this, make sure your cloud backups are running daily. Pixel phones are a bit more conservative and will just make you wait longer and longer between attempts.

Our recommendation

After testing all the options, my recommendation for the average person is a 8-digit PIN combined with a fingerprint. Why 8 digits? It's the "sweet spot." It provides 100 million combinations, which is more than enough to stop any casual thief or even most sophisticated attackers, yet it's still easy to remember. To set this up, go to your Screen Lock settings, choose PIN, and make sure you disable the "Confirm PIN without tapping OK" option. Requiring that "OK" tap adds one extra layer of protection because an attacker doesn't know exactly how long your PIN is. It’s a small bit of friction that provides a whole lot of peace of mind when you're out in public.