Android 17 Caps Failed Lock-Screen Guesses at 20, Tightening PIN Rate Limits

Q: After 20 failed PIN attempts on Android 17, are you permanently locked out of your phone and data forever?

No. After 20 failed PIN or password attempts on Android 17, you are not locked out of the phone forever in the sense that the device becomes unusable, but you are effectively locked out of unlocking it with that PIN entry screen. Android 17 imposes a hard cap: after 20 wrong attempts, the phone stops accepting further guesses. That is the key security change. It is meant to block brute-force attacks, especially against weak or common PINs. Google also added duplicate-guess detection, so repeating the same wrong PIN does not keep consuming the limit. For a legitimate owner who truly forgot the PIN, the practical outcome is usually that the device must be recovered or reset rather than guessed further. Android 17 now shows a recovery shortcut on the lock screen to help users find account-recovery options from another device. In most real cases, regaining use of the phone without the correct PIN means a factory reset. That means the phone itself is not permanently dead, but data stored only on the device may be lost if you cannot remember the correct PIN and have to reset it. If your photos, contacts, and files were backed up, they can usually be restored after setup. If they were not backed up, that local data may be unrecoverable. So the short answer is: no permanent device lockout, but yes, after 20 failed attempts, further PIN guessing ends, and your data may be effectively lost unless you know the correct PIN or have backups.

2 articles · Updated · Android Authority · Jul 1

Google has cut Android’s failed PIN and password ceiling to 20 attempts in Android 17, replacing a far looser system that once allowed up to 1,800 guesses over five years.
Six wrong entries now trigger much faster throttling—rising to just seven within six minutes, eight within 25 minutes, 12 over 24 hours, and 19 across five years before the final block.
Duplicate wrong entries no longer count against the limit, letting users who repeat the same mistaken PIN avoid burning attempts while seeing a message explaining the exemption.
Android 17 also makes lockouts easier to navigate with clearer wait-time messages such as minutes instead of seconds, plus a lock-screen recovery shortcut for account help from another device.
Google says the stricter policy targets attackers who exploit common PIN choices and personal details like birthdays or anniversaries to improve their odds.