Overview
- Android 17 enforces a sharp attempt budget confirmed by Android staff that limits users to 19 incorrect guesses spread over long periods and locks the device after a 20th wrong try.
- The new limits break down into small windows so guesses are tightly throttled: six in the first minute, seven within six minutes, eight within 25 minutes, 12 over 24 hours and 19 over five years.
- After the 20th incorrect entry the phone enters a lockdown state and shows a recovery shortcut on the lock screen that offers ways to regain access on a new device, though exact recovery steps remain partly unspecified.
- Google is also rolling out duplicate‑guess detection starting with Android 16 QPR2 so repeated identical wrong PINs count once and the OS will warn users when the same guess is being repeated.
- The change aims to block attackers who exploit common PINs but shifts more weight to recovery workflows and vendor update timing, and it depends on OEM rollouts since the protections arrive as OS updates on select devices including Pixel phones.