Your phone’s lock screen is supposed to be a safeguard against the world (and accidental unlocks in your pocket). When it’s locked, your phone can’t be opened without either the passcode, a face scan, or a fingerprint. If you lose your phone or someone snatches it from you, you can rest assured they won’t be able to do anything with it. Except right now they can, thanks to a recently discovered vulnerability allowing anyone to bypass an Android device’s lock screen.
As reported by Bleeping Computer, cybersecurity researcher David Schütz discovered a way to unlock both a Google Pixel 6 and Pixel 5 without needing to know the passcode. It happened after his Pixel 6 ran out of charge, and after he incorrectly entered his PIN wrong three times. His SIM card was then locked, so he entered the PUK (Personal Unblocking Key) to restore it.
However, once the SIM was recovered, the Pixel asked him to scan his fingerprint. That shouldn’t happen, since Pixels (as well as most phones) require you to enter the passcode in order to unlock after a reboot. You shouldn’t have the option to use your fingerprint to unlock the phone until after one successful unlock with the passcode.
From there, Schütz realized there was a legitimate security flaw here. If an attacker inserts their own SIM into a target’s Android, then enters the wrong SIM PIN three times, they can enter their SIM’s PUK to be able to create a new SIM PIN. Once they do, they bypass the lock screen entirely and access the phone. You can watch the hypothetical attack play out in the video below:
Pixel 6 Full Lockscreen Bypass POCSchütz brought this flaw to Google’s attention back in June of this year, but it took the company five months to finally push a patch. Still, it’s good there is a patch: It’s not clear how long this vulnerability was actually floating around, potentially putting millions of Androids in jeopardy.
How to fix the latest lock screen security flaw on Android
If you have a phone running Android 10, 11, 12, or 13, you need to install the November 2022 security update in order to patch this vulnerability. If you already installed the patch, you’re good to go! But otherwise, install it ASAP.
To install a security patch on Android, head to Settings > System > System Update, then allow the OS to look for a new update. If there’s one available, you can download and install it from here. You can also check for security updates from Settings > Security > Google Security checkup.
It’s a disconcerting experience, to say the least, to be locked out of your own phone. Whether you forgot the password or bought a second-hand phone that arrived still locked from the last user, it can bring your day to a halt. But an Android phone can be unlocked in other ways. If you are concerned about being able to recover your phone in case you are locked out of it without your password, you should make sure you keep your phone signed into your Google account. This will allow you to unlock your phone from another Android device. Keep in mind that different phone manufacturers have different supplemental ways to unlock their phones. Let’s go over the various ways to unlock your Android phone in the absence of a password or PIN.
Read more: How to create a strong password
QUICK ANSWER
To unlock your Android phone without a password, activate Smart Lock on your Android phone in the same Settings submenu where you set your screen lock. Then if you ever forget your password, you can just pick up the phone and it will unlock.
JUMP TO KEY SECTIONS
Google Find My Device
Google has a free service called Find My Device (which used to be called Android Device Manager). If your phone is signed into your Google account and has its location turned on, you will be able to choose it from your registered Android devices and see its location on a map.
Kevin Convery / Android Authority
Click or tap on Secure Device. Once you have the phone locked, click on Erase Device. Once you erase your phone, you won’t be able to locate it, but you will be able to set a new password, so you can unlock it. From there, you can reload your apps and your photos through your Google account.
Android Smart Lock
Unlocking your phone could be just a matter of putting it in your pocket or taking it home. That’s because Android has had a built-in feature since version 5 called Smart Lock. It’s a proximity-based condition for your lock screen that keeps your phone unlocked when it is in one of three places:
- On your person (like in your pocket or in your hand)
- At a location that you have specified
- Near another Android device that you have specified
There’s just one hitch to Smart Lock, and you’ve probably already guessed it: You can’t turn it on after you have been locked out of your phone. You must set it up in advance. If you are interested in doing this on your Android phone, open your phone’s Settings app and tap on Security & lock screen and then Smart Lock. (You won’t see this control if you do not have a screen lock set up.)
Kevin Convery / Android Authority
From a locked state, you can reset an Android phone by pressing the power button and the volume down button at the same time, and holding them. (Make sure your phone is connected to a charger when you do this, because the process is power-intensive.) First the Android logo should appear, then a menu. Scroll down using the volume buttons until you are on Recovery and press the power button again. Now you are in the reset menu. Scroll again with the volume buttons until you are on Wipe data/factory reset and press the power button. You’ll be asked to confirm the reset; press the power button one more time to do so. The reset will commence. When it is done, the phone should be powered off. Turn the phone back on and begin downloading your backup from Google (if you have one) or reinstalling your apps.
Some phones have a physical home button. If your phone is like this, instead of just pressing the power and volume up buttons at the beginning of the process, press the home button as well.
How to unlock a Samsung phone without password
A little over one in four cell phones in the world today are made by Samsung. If you have a Samsung phone and look at, for instance, a Pixel, you’ll notice that Samsung puts its own spin on some aspects of Android. This sometimes results in redundant apps, and settings menus being a little different. One of these redundancies is while Google has Find My device, Samsung has Find My Mobile.
When you go to the site, you will have to log into your Samsung account. Once you do, you’ll be shown a map and a list on the left-hand side with all of your Samsung devices that are currently switched on, connected to Wi-Fi or cellular, and have Remote Unlock activated. Select the locked device, and you will see your options in a window in the upper right. One of those options is Unlock. Click on it and confirm when asked. In a few seconds, your phone is unlocked and ready to use. Like Android Smart Lock, Remote Unlock must be set up in advance to be effective. So why not go set it up right now, fellow Samsung users?
Kevin Convery / Android Authority
What's the best password that's easy to remember?
The latest advice from the National Institute of Standards and Technology is that length (a password with more characters) provides far better protection against password hacking than complexity (including special characters, numbers, etc.). So for a secure password that’s easy to remember, consider a passphrase, like “Twodozendancingelephants.” Just remember to make it long and use an image or word sequence that you will remember. And remember not to include any information that can be used to identify you.
Is a phone password required?
No, it isn’t. You can disable all passwords and screen locks if you prefer. If you do, try to limit the personal information you store on the device.
Can I locate a stolen phone with Google Find My Device?
If the phone is still turned on, connected to Wi-Fi or cellular, and signed in to your Google account, then yes, you can use Google Find My Device to locate a stolen phone.
Can an iPhone locate an Android device?
Since Google Find My Device is a web-based service, it can be reached on any phone that has web access, Android or iOS. The web page will display the devices of whoever logs in.