How to Lock Your Phone So Only You Can Open It
The very first thing to configure on a new smartphone is the lock. The second thing is to make sure you actually understand what each option does.
Most people inherit their lock setup from whoever sold them the phone. That setup is usually fine for an average user in their thirties. It is not particularly thoughtful for someone in their seventies with sensitive accounts on the device.
The options sound similar. They aren't. Here is what each one actually is.
Face ID — what it actually is
The iPhone's Face ID works by projecting a pattern of invisible infrared dots at your face and measuring how those dots fall on your features. The phone has a 3D map of your face stored locally. When you pick up the phone, it compares what it sees to that stored map. If it matches, the phone unlocks.
The accuracy in 2026 is genuinely excellent. Glasses are fine. Hats are fine. A surgical mask isn't always fine, though the phone does its best with the eyes if you train it to recognize you that way. Heavy makeup is fine. Aging is fine — the phone learns your face slowly over time.
Face ID doesn't work in two situations worth knowing: when your eyes aren't open (so a sleeping person can't be unlocked just by holding the phone up to their face), and when you're at a very steep angle from above (which is why looking down at the phone in your lap sometimes doesn't work).
Fingerprint
Available on iPhone SE and all current Android phones in some form. On Pixel and most Samsung phones, the sensor is built into the screen — you press your finger on a specific area of the bottom of the display. On iPhone SE, it's the round Home button.
The accuracy is also very good but worse than Face ID with one specific exception: in a bright sunlit room, Face ID occasionally hesitates because the infrared camera can't read the dot pattern as cleanly. Fingerprint doesn't care about light. Also, fingerprint works through gloves only if the gloves are the special touchscreen kind, and it gets confused by wet fingers.
You can register up to five different fingerprints on most phones. Register both thumbs and both index fingers — that covers almost every grip you'll use to pick up the phone.
The six-digit PIN
This is the fallback. Even if you use Face ID or fingerprint, the phone will sometimes ask for the PIN — after a restart, after a few failed biometric attempts, after a long period of being locked, and immediately after software updates. You will type the PIN. You need to know it.
Pick six digits that aren't your birthday, your spouse's birthday, or your address. Don't use 123456 (the most common PIN on stolen phones), 000000, or 111111. A good trick: the last six digits of an old phone number from decades ago — long forgotten by anyone else, instantly remembered by you.
Write the PIN in your home notebook (the same notebook from the password guide). Tape it inside the door of a kitchen cabinet if that's easier. The risk of forgetting the PIN is not theoretical. Plenty of seniors end up locked out of their own phone for days because they changed it and didn't write it down.
The longer password option
Both phones allow you to use a longer password instead of a six-digit PIN, made up of letters and numbers. This is slightly more secure. It is also slightly slower to type and slightly easier to forget.
For most ordinary users, the six-digit PIN with biometric unlock on top is the right level of security. For someone with extraordinarily sensitive data on the phone (a lawyer with privileged client material, a journalist working with sources), a longer password makes sense. For everyone else, don't bother.
The mistake that bypasses all of this
Setting the "Auto-Lock" time too long, or — worse — to "Never."
"Auto-Lock" is the setting that decides how long the screen stays awake without you touching it before it goes dark and re-locks. The default on most phones is one minute. Many users find this annoying — they put the phone down to read something on it, and a minute later it's dark again. So they go into settings and change Auto-Lock to ten minutes, or thirty, or Never.
The problem: while the screen is awake, the phone is unlocked. Anyone who walks up and picks up the phone can open any app, send any message, read any email, all without needing your face or fingerprint. A phone set to "Never auto-lock" might as well not have a lock at all.
The right Auto-Lock setting for most people is two minutes — long enough that the phone doesn't shut off in the middle of reading a long email, short enough that a forgotten phone on a coffee shop table doesn't expose everything inside.
iPhone: Settings → Display & Brightness → Auto-Lock → 2 Minutes. Android: Settings → Display → Screen timeout → 2 minutes.
What about Apple Watch unlock
If you wear an Apple Watch, you can configure it so the iPhone unlocks automatically when the watch is unlocked and on your wrist. This is convenient. It also slightly weakens the security model — if someone takes both your phone and your watch in a robbery, they can sometimes use the watch to unlock the phone.
The honest call: leave it off. The convenience usually isn't worth the trade-off. Your judgment may differ, and that's fine.
One thing worth doing today
Open Settings → Privacy & Security (iPhone) or Settings → Security & privacy (Android). Find "Lock Screen" or "Always Show on Lock Screen." Look at what notifications appear on the lock screen when the phone is locked.
By default, on most phones, the contents of your text messages appear in lock-screen previews. Anyone who picks up your phone can read the most recent texts without unlocking. For most messages this is fine. For two-factor authentication codes (covered in our 2FA piece), it isn't — the whole point of 2FA is that nobody else has access to those codes.
The setting you want is "Show Previews: When Unlocked" on iPhone, or the equivalent on Android. With this on, the lock screen says "Messages: New message" but doesn't show the actual content until you've unlocked.
Small change. Big improvement.
Written by Justin Lowen. Last verified 5 June 2026.