Android 17 will severely limit smartphone unlock attempts on compatible devices

Attempts to unlock a smartphone will be far more restricted on Android 17 devices that support this feature. The aim is to keep a user’s data safe if a thief tries multiple combinations based on personal details such as a birthday.

Android 17 is on the way and, among its changes, Google is rolling out a range of security upgrades. One of them is a new mechanism designed to make the lock screen harder to defeat in the event of theft. Google first outlined this improvement in May, saying it had reduced “the number of attempts allowed to guess the PIN or password, and increased the delay between failed attempts” on “compatible” models.

This week, Mishaal Rahman, a Google employee, set out how the mechanism works on the social network X. On Android 16, the system permits 10 unlock attempts in the first minute, then 20 in 6 minutes, 50 in 25 minutes, 110 over 24 hours, and 1,800 attempts across 5 years. With the Android security update, however, those figures are tightened significantly. Specifically, the new policy allows only 6 attempts in the first minute, 7 in 6 minutes, 8 in 25 minutes, 12 in 24 hours, and 19 in 5 years. *“No further attempts are allowed after 20 unsuccessful attempts”*, Mishaal Rahman also notes.

Why Google is tightening Android 17 unlock attempts

The approach is strict, but it is presented as a proportionate response. The Google employee explains that while PIN and password protection is already fairly strong on Android 16, it is weakened in practice because most people do not choose truly random codes or passwords. Since many combinations can be tried, someone who knows personal information about the user-such as their date of birth-can improve their chances of unlocking the handset. To address this risk, Google has therefore sharply limited the number of attempts.

Wrong code entries won’t unfairly penalise users

Google has also tried to ensure that people who simply make mistakes are not unduly punished. “Users are not penalised for entering the same incorrect answer multiple times, and these rejections do not increase the number of incorrect answers,” Mishaal Rahman explains. In addition, system warning messages displayed when a password is wrong will be made more noticeable.

For reference, Google has already rolled out Android 17 to compatible Google Pixel devices. The new operating system should now reach other brands gradually.