Google tightens Android 17 lock‑screen PIN attempt limits

Google’s upcoming Android 17 update dramatically reduces the number of failed PIN or password entries allowed on a device’s lock screen. The limit drops from as many as 1,800 attempts over five years in earlier versions to just 19 total failed attempts. New per‑interval caps allow only six wrong entries in the first minute, seven in five minutes, eight in 25 minutes, twelve in a day and nineteen over five years. After the 20th incorrect try, further attempts are blocked and the device imposes longer lock‑out periods.

The system also recognises repeated identical wrong PINs and excludes them from the attempt count, preventing accidental lock‑out from simple typos. Lock‑screen messages now display wait times in minutes (e.g., “Try again in 30 minutes”) instead of raw seconds, and a recovery link appears for users who have forgotten their credentials. Google says the change aims to thwart attackers who exploit predictable PINs, such as dates of birth, by limiting the opportunities to guess a code.

These restrictions are enabled by default on all Android 17 devices, requiring no user action.