Apple to require 6-digit passcodes on newer iPhones, iPads under iOS 9
Stronger passcode ups the ante: there will be one million possible permutations. — As part of its iOS 9 announcement on Monday, Apple revealed that all newer iDevices equipped with TouchID and running the newer version …
Context & Ripple Effects
With iOS 9, Apple makes six digits the default for new passcodes on Touch ID-equipped iPhones and iPads — one million permutations instead of ten thousand — the most significant change to the lock screen since Touch ID arrived. The requirement applies only to 'newer' devices, so Apple is tying stronger defaults to hardware it controls.
Read against later coverage, this is the opening move of a long arc: Apple went on to harden its credential store with Keychain two-factor authentication, layered location limits onto account changes with Stolen Device Protection, and eventually demoed passkeys that replace passwords entirely, joining Microsoft and Google in pushing passwordless sign-in.
First-order effects
- Owners of Touch ID iPhones and iPads moving to iOS 9 are pushed into six-character codes, raising possible permutations a hundredfold and making casual guessing and shoulder-surfing far less productive.
- Anyone deliberately keeping a four-digit code now has to opt out of the stronger default explicitly, turning a passive weak setting into a visible choice.
Second-order effects
- Brute-force and entry-limit attacks get more expensive, so attackers and forensic toolmakers pivot to bypasses — a path researchers took in 2018 with a computer-connected method that defeats the passcode attempt limit without wiping data on firmware as recent as iOS 11.3.
- Because the mandate rides on Touch ID-capable hardware, Apple effectively uses its upgrade cycle to retire old defaults: the strength of device security becomes a function of how recently a customer bought in.
Third-order effects
- The pattern points toward the passcode demoted to fallback rather than front-line credential — biometric unlock, hardened keychains, and stolen-device safeguards progressively absorbing the job of authenticating the owner.
- If Apple, Microsoft, and Google continue down the passkey route they jointly advocated, the industry endpoint is phones whose identity checks live in biometrics and synced hardware-backed keys, not anything a user memorizes.
The trend: Mobile authentication has spent a decade climbing from short numeric PINs toward biometrics and passwordless credentials, with each iOS release raising the cost of both guessing and physical extraction.