Google is planning on making Android 17 even more secure. The company had previously confirmed that Android 17 will now reduce the number of times someone can guess your PIN or password and add longer wait times between failed attempts.
Now, thanks to a deeper breakdown from Mishaal Rahman, we have a better idea of how aggressive that change really is.
The old system gave attackers too much room
Older Android builds allowed far more failed unlock attempts over time. Android 16 could allow up to 10 guesses in the first minute, 20 within six minutes, 50 within 25 minutes, 110 over 24 hours, and as many as 1,800 guesses over five years.
Android 17 tightens that window heavily. The new limits reportedly allow only six guesses in the first minute, seven within six minutes, eight within 25 minutes, 12 over 24 hours, and 19 over five years. After 20 incorrect attempts, the phone stops accepting further guesses.
A stolen phone, a weak PIN, and enough time can be a bad combination, especially if the attacker knows personal details like birthdays, anniversaries, or common number patterns. But the next major Android update will make the guessing game much shorter.
Real users get some protection too
This does come with an added risk of stricter lockouts, which can harm legitimate users as well. Though Android 17 tries to soften that problem with duplicate-guess detection. If you accidentally type the same wrong PIN repeatedly, Android can recognize the duplicate and avoid counting it as a fresh failed attempt. The lock screen will also show clear messages, so users are not staring at confusing countdowns or wondering why the phone is refusing more entries.
Phones now hold banking apps, saved passwords, passkeys, private chats, photos, location history, and two-factor authentication messages. Once someone gets past the lock screen, the damage can be quick and devastating. So while people are complaining about the lackluster updates in Android 17 over Android 16, at least security is not taking a back seat.