iPhone locks you out after six failed attempts, then enforces longer waits

Your iPhone will let you try your passcode six times before it stops accepting attempts for one minute. After that, the waits get longer: five minutes after the next failed attempt, then 15 minutes, then one hour. If you reach ten failed attempts total, the phone erases itself — but only if you turned on the security setting that does this, which most people have not.

The six-attempt window is the practical limit for guessing. After that, the phone is essentially locked until you wait out the timer, and the timers grow long enough that brute-force guessing becomes pointless. The one-hour lockout after nine failures is the real barrier.

The self-erase feature — called Erase Data — is optional and off by default. You turn it on in Settings under Face ID & Passcode (or Touch ID & Passcode on older phones). If you do turn it on and hit ten wrong attempts, the phone wipes itself completely, including photos, messages, and apps. You cannot undo this.

Key Takeaways

  • You get six free attempts to enter your passcode before the phone locks for one minute.
  • After the first lockout, each subsequent wrong attempt triggers longer waits: five minutes, then 15 minutes, then one hour.
  • The phone will not erase itself after ten wrong attempts unless you manually turned on the Erase Data setting in passcode settings.
  • If Erase Data is on and you hit ten failures, the phone erases everything without warning or recovery option.
  • The lockout timers reset if you restart the phone or wait long enough that the phone goes to sleep and wakes again.

What happens after each wrong attempt

Attempts one through six have no penalty — you can try again immediately. On the seventh attempt, the phone displays "iPhone is disabled. Try again in 1 minute" and stops accepting passcode input.

After that one-minute wait, you can try again. If the eighth attempt is wrong, the message changes to "Try again in 5 minutes." The ninth wrong attempt locks you out for 15 minutes. The tenth locks you out for one hour. These timers count down in real time; you cannot speed them up by restarting the phone or plugging it in.

If you reach a one-hour lockout and then fail again on the eleventh attempt, the phone will erase itself — but again, only if you turned on Erase Data. Without that setting, the phone simply stays locked for one hour and does nothing else.

The Erase Data setting and what it actually does

Erase Data is a security feature you have to turn on deliberately. Go to Settings, then Face ID & Passcode (or Touch ID & Passcode), scroll down, and toggle on "Erase Data." Once it is on, the phone will erase itself after ten failed passcode attempts.

This is permanent and irreversible. The phone does not ask for confirmation or give you a warning before the tenth attempt. It simply wipes everything: your photos, messages, contacts, apps, settings, and any data stored on the phone. You cannot recover this data from the phone itself, though you may be able to restore from an iCloud backup if you set one up before the erase happened.

Most people do not turn this on. If you did not deliberately enable it, your phone will not erase itself no matter how many wrong attempts you make. You will just be locked out for one hour after the ninth failure.

How to recover access if you are locked out

If you are locked out and do not remember your passcode, you cannot wait it out — the timers only reset if you successfully enter the correct code. Your options are to use Recovery Mode (which erases the phone but lets you set a new passcode) or restore from an iCloud or iTunes backup.

Recovery Mode is built into every iPhone. Connect the phone to a computer with a USB cable, open Finder (on Mac) or iTunes (on Windows), and select the phone. Choose "Restore" and follow the prompts. This erases the phone and installs a fresh copy of iOS, after which you can set a new passcode. You will lose any data not backed up to iCloud.

If you have an iCloud backup, you can restore from it after Recovery Mode finishes. Go to Settings, tap your name at the top, select iCloud, and look for the backup. This restores your photos, messages, and apps from the date of the last backup.

Why the lockout timers exist

The lockout system is designed to stop someone from guessing your passcode by trying many combinations in a row. A four-digit code has 10,000 possible combinations; without lockouts, someone could try all of them in minutes. The six free attempts plus the escalating waits make this impractical — after nine failures, you are locked out for one hour, and the person trying would have to wait that long between each new attempt.

The Erase Data feature is a last resort for people who want the phone to destroy itself rather than let someone access it. This is useful if you work with highly sensitive information or live in a place where device seizure is a real risk, but it is overkill for most people and dangerous if you or someone else might forget the passcode.

Resetting the lockout timer

The lockout timers do not reset if you restart the phone, plug it in, or turn it off and on again. They count down in real time, and you have to wait the full duration. The only way to reset the timer early is to enter the correct passcode, which unlocks the phone immediately and clears all the failed attempts.

If you restart the phone during a lockout, the timer will still be running when it boots back up. The phone remembers how many failed attempts you made and how long you have left to wait.

Passcode length and how it affects your security

A longer passcode makes guessing much harder. A four-digit code has 10,000 combinations; a six-digit code has one million. Even with the lockout timers removed, someone would need weeks to try all six-digit combinations. With the timers in place, it becomes impossible in any practical timeframe.

You can set a passcode of any length in Settings under Face ID & Passcode. The default is six digits, but you can choose four digits, six digits, or a custom alphanumeric code (letters, numbers, and symbols). A longer code is harder to guess but also harder to remember and slower to type every day.

Frequently Asked Questions

Does restarting my iPhone reset the lockout timer?

No. The lockout timer continues counting down even if you restart the phone. The phone remembers your failed attempts and the remaining wait time when it boots back up. You have to wait the full duration before you can try again.

What if I forgot my passcode and the phone is locked for one hour?

You cannot wait out a permanent lockout. Use Recovery Mode on a computer to erase the phone and set a new passcode. Connect the phone to a Mac or Windows computer, open Finder or iTunes, select the phone, and choose Restore. This erases everything but lets you create a new passcode.

Can I turn off Erase Data after I turn it on?

Yes. Go to Settings, Face ID & Passcode, and toggle off "Erase Data." Once it is off, the phone will not erase itself after ten failed attempts. Any failed attempts you already made are forgotten once you turn it off.

Does Face ID or Touch ID count toward the six-attempt limit?

No. Face ID and Touch ID do not have attempt limits. You can try Face ID or Touch ID as many times as you want. The six-attempt limit applies only to passcode entry. If Face ID or Touch ID fails, the phone asks for your passcode instead.

What if someone else keeps trying my passcode?

After six attempts, the phone locks them out for one minute, then five minutes, then 15 minutes, then one hour. This makes it extremely difficult to guess a passcode by brute force. If you are concerned about someone trying to access your phone, use a longer passcode (six digits or alphanumeric) and consider turning on Erase Data.