Someone saw your iPhone passcode: what to do now
A passcode seen over your shoulder is a passcode someone else now has.
In short
Change your passcode as soon as you can, in Settings › Face ID & Passcode › Change Passcode, ideally to a custom alphanumeric code. Until you do, anyone holding your phone with that code could open the Hidden album, saved passwords and your Apple Account settings. Turn on Stolen Device Protection, and use Face ID in public so you type the code less often.
Key takeaways
- Change the passcode now, not tonight.
- The passcode opens far more than the Lock Screen.
- Stolen Device Protection makes a stolen passcode much less useful.
Change it now
- Go to Settings › Face ID & Passcode and enter your current passcode.
- Tap Change Passcode.
- Tap Passcode Options and choose Custom Alphanumeric Code or Custom Numeric Code — Apple calls these the most secure options.
With Stolen Device Protection on and the phone away from a familiar place, changing the passcode comes with a one-hour security delay. Start it anyway, and keep the phone with you until it completes.
What the passcode could open
- The phone itself, whenever Face ID is skipped or fails.
- The Hidden and Recently Deleted albums in Photos.
- Apps you locked with Require Face ID — the passcode opens them too, unless Stolen Device Protection applies.
- Saved passwords and Apple Account settings — unless Stolen Device Protection is on and the phone is away from familiar places.
If the phone left your hands after the code was seen, also check Settings › Face ID & Passcode: if you’re not sure who set up Face ID’s appearances, tap Reset Face ID and set it up again. Then check the devices signed in to your Apple Account.
Turn on Stolen Device Protection
In Settings › Face ID & Passcode › Stolen Device Protection. Away from places like home or work, it requires Face ID or Touch ID — no passcode fallback — to use saved passwords, erase the phone or open a locked app, and it adds a one-hour delay before your Apple Account password or passcode can be changed. It needs two-factor authentication, Find My and Significant Locations.
Type it less, and less visibly
Face ID unlocks the phone for most of the day, but iOS still asks for the passcode after a restart, after 48 hours without unlocking, and in a few other cases. Those are the moments to shield the screen. A longer alphanumeric code is also much harder to read from a glance than four or six digits.
A second secret for what matters most
Whatever relies only on the passcode is exposed every time it is seen. Latent opens with its own pattern or password, independent of the iPhone passcode, so a code seen over your shoulder doesn’t open your vault.