Passcode

The Apple passcode policy defines security requirements for device passcodes on watchOS devices.

The policy offers a wide range of options to further adapt passcode security. These include requirements for complexity, length, validity period, and the number of allowed failed attempts.

As soon as the policy is applied to a device, a device passcode is always required. Fields left empty are not sent to the device; the policy imposes no requirement for these settings.

Configuration options #

• Allow simple passcode (enabled by default): Allows passcodes with repeated or ascending/descending character sequences such as aaa, abc or 123.

• Require alphanumeric values (disabled by default): Specifies whether the passcode must contain letters or whether digits are sufficient.

• Minimum passcode length: Values from 0 to 25 characters.

• Required number of special chars (1-4): Values from 0 to 4.

• Maximum passcode age (in days): Number of days after which a new passcode has to be set; values from 0 to 730.

• Inactivity time (in minutes): Maximum auto-lock time after inactivity that the user can select on the device.

• Passcode history: Number of previously used passcodes that cannot be set again; values from 1 to 50.

• Grace period for device lock (in minutes): Period after locking during which the device can still be unlocked without entering the passcode. With Immediately, the passcode is required every time the device is unlocked. This setting does not determine when the device locks – that is controlled by Inactivity time (in minutes).

  • Immediately
  • 1 minute
  • 5 minutes
  • 15 minutes
  • 60 minutes
  • 4 hours

• Maximum number of failed attempts: Values from 2 to 11.

  If the limit is exceeded, a wipe action is triggered.