PIN vs pattern vs passphrase vs face or fingerprint: which should you use?

A lock is only as good as the easiest way around it. For a phone or a vault app, that usually means one of four things: someone guesses it, someone watches you type it, someone finds the smudge, or someone makes you open it. Each way of unlocking handles these differently.

How hard is each one to guess?

Count the possibilities, then ask how fast an attacker can try them.

Method	Possibilities	Comment
4-digit PIN	10^4 = 10,000	Fine only with strict guess limits
6-digit PIN	10^6 = 1,000,000	A good balance for daily use
8-digit PIN	10^8 = 100,000,000	Slower to type, much harder to guess
Pattern on a 3x3 grid	Under 400,000 possible shapes, far fewer in practice	People repeat a handful of starting points and shapes
Passphrase of 4 random words	About 10^15 if drawn from a list of 7,776 words	Easy to remember, hard to guess
Passphrase of 5 random words	About 10^19	Very strong

These numbers assume the choice is random. Real people are not. Birth years, repeated digits and “1234” are tried first, and patterns shaped like a letter or starting at a corner are guessed early.

Guess limits and slow keys

An app can slow guessing in two ways. A guess counter adds waiting time after wrong tries, which helps against someone using the phone’s screen, but not against someone who copies the files off and guesses on their own computer.

The stronger defense is a slow key derivation. This is the step that turns your PIN into the encryption key. A function such as Argon2id is built to be slow and to use a lot of memory, so every guess costs real time even on powerful hardware. It does not rescue a weak PIN, but it makes each of those million guesses far more expensive.

Shoulder-surfing and smudges

• PIN: Someone watching can read six digits quickly. Shield the screen on trains and in cafes.
• Pattern: The easiest to read by eye, because the whole shape is one gesture. Smudges on the screen can also show it.
• Passphrase: Slower to type, but the characters can be hidden as you type, and nobody can read it from a smudge.
• Face or fingerprint: Nothing to watch. This is the strongest defense against onlookers.

Being made to unlock

A PIN, pattern or passphrase lives in your head. A face or finger does not. Someone can hold your phone up to your face while you sleep, or press your finger on the sensor. In some places the law treats a fingerprint differently from a password, which is another reason this gap matters.

If any of this could apply to you, turn biometrics off when it matters. Many phones can disable face and fingerprint unlock until the next PIN entry, so check what your phone offers. Remember that biometrics usually sit on top of a PIN or passphrase, which is the real lock.

What to choose

• Daily phone and apps: A 6-digit PIN or longer, with face or fingerprint for convenience.
• Something very private, or a stronger lock: A passphrase of 4 or 5 random words.
• Avoid: Patterns, birthdays, repeated digits, and anything you also use for a bank card.
• Whatever you pick: Pair it with auto-lock so the phone locks quickly when you put it down.

What Silo offers

Silo takes a PIN of 6 or more digits, or a passphrase (a Pro feature, at least 8 characters). Face or fingerprint unlock is optional and sits on top, and your PIN or passphrase still works as a backup. Your PIN or passphrase is run through Argon2id to produce the key that opens your vault, so guessing is slow. Silo has no pattern option.