What's the entropy of smartphone "pattern passwords"? Through how many nodes do I have to go until I'm safe (say, a reasonable 42 bits of strength)?


1 Answer 1


You cannot reach 42 bits of entropy with a regular android unlock pattern. The 3x3 grid is limited to 389,112 distinct patterns, giving you an entropy of 18.57 bits. This is less than you might assume since a dot cannot be selected twice and you cannot skip intermediate dots on a straight line.

Additionally, research has shown that many actual patterns are predictable and in fact much less complex than they could be. For instance, a majority of users begin their pattern in one of the four corners.

Besides the low entropy there are other security problems with unlock patterns such as the smudge attack. If a pattern alone can be a suitable security measure has also been discussed here.

BTW, some mods (e.g. Cyanogen mod) support bigger grid sizes but I personally find a truly random pattern harder to remember than an equivalent PIN code.

  • 2
    18 bits eh? In other words, the longest possible unlock pattern is roughly equivalent to a 5 character password. Interesting... Commented Nov 6, 2016 at 18:02
  • 1
    Better than a 4 character pin Commented Nov 6, 2016 at 19:43
  • 2
    It's even worse... there is research that suggests that the pattern is actually visible sometimes because of the oily residue our fingers leave on the screen surface. Even if it is partly unrecoverable due to smudges caused by later input, part of it may be recovered sometimes. Commented Nov 6, 2016 at 20:24
  • For a 4x4 grid, Aviv et al (doi:10.1145/2818000.2818014) calculate 4*10^13 theoretically possible combinations, while they find the majority of real-world patterns on a 4x4 grid to be of similar strength as a 3 digit pin. Commented Sep 25, 2017 at 8:59

Not the answer you're looking for? Browse other questions tagged .