--- title: Passcode framework: devicemanagement role: symbol role_heading: Device Management Profile path: devicemanagement/passcode --- # Passcode The payload that configures a passcode policy. ## Declaration ```data object Passcode ``` ## Properties allowSimple: If false, the system prevents use of a simple passcode. A simple passcode contains repeated characters, or increasing or decreasing characters, such as 123 or CBA. changeAtNextAuth: If true, the system causes a password reset to occur the next time the user tries to authenticate. If this key is set in a device profile, the setting takes effect for all users, and admin authentications may fail until the admin user password is also reset. Available: macOS 10.13+ customRegex: Specifies a regular expression, and its description, used to enforce password compliance. Use the simpler passcode restrictions whenever possible, and rely on regular expression matching only when necessary. Mistakes in regular expressions can lead to frustrating user experiences, such as unsatisfiable passcode policies, or policy descriptions that don’t match the enforced policy. Available: macOS 14+ forcePIN: If true, the system forces the user to enter a PIN. maxFailedAttempts: The number of failed passcode attempts that the system allows the user before it erases or locks the device. After six failed attempts, the device imposes a time delay before the user can enter a passcode again. The time delay increases with each failed attempt. On macOS, set minutesUntilFailedLoginReset to define the time delay. The time delay begins after the sixth attempt, so if MaximumFailedAttempts is six or lower, the system has no time delay and triggers the erase or lock as soon as the user exceeds the limit. After the final failed attempt, the system locks a macOS device, or securely erases all data and settings from an iOS, visionOS, or watchOS device. maxGracePeriod: The maximum grace period, in minutes, to unlock the phone without entering a passcode. The default is 0, which is no grace period and requires a passcode immediately. On macOS, the system translates this grace period value to screen-saver settings. maxInactivity: The maximum number of minutes for which the device can be idle without the user unlocking it, before the system locks it. When this limit is reached, the system locks the device and the passcode is required to unlock it. The user can edit this setting, but the value can’t exceed the maxInactivity value. On macOS, the system translates this inactivity value to screen-saver settings. The maximum value for macOS is 60. Setting this key removes the never option in the Settings UI on user enrolled devices. maxPINAgeInDays: The number of days for which the passcode can remain unchanged. After this number of days, the system forces the user to change the passcode before it unlocks the device. minComplexChars: The minimum number of complex characters that a passcode needs to contain. A complex character is a character other than a number or a letter, such as &, %, $, and #. The system ignores this property for user enrollments. Available: iOS 4+ | iPadOS 4+ | macOS 10.7+ | visionOS 2+ minLength: The minimum overall length of the passcode. This value is independent of the value for minComplexChars. minutesUntilFailedLoginReset: The number of minutes before the system resets the login after the maximum number of unsuccessful login attempts is reached. This key requires setting maxFailedAttempts. Available: macOS 10.10+ pinHistory: This value defines N, where the new passcode must be unique within the last N entries in the passcode history. requireAlphanumeric: If true, the system requires alphabetic characters instead of only numeric characters. Available: iOS 4+ | iPadOS 4+ | macOS 10.7+ | visionOS 2+ ## Discussion Discussion Specify com.apple.mobiledevice.passwordpolicy as the payload type. The presence of this payload type causes the device to present the user with a passcode entry mechanism. The payload controls the complexity of the passcode. For user enrollments, the system allows this payload type, but ignores most of the keys. Instead, the presence of the payload forces only these settings: allowSimple: always set to false forcePIN: always set to true minLength: always set to 6 maxInactivity: if this key is present its value is ignored, but the never option is removed in the Settings UI. Profile availability | | | | | | | | Profile example PayloadContent allowSimple forcePIN maxFailedAttempts 5 maxGracePeriod 1 maxInactivity 2 maxPINAgeInDays 30 minLength 8 pinHistory 2 requireAlphanumeric PayloadIdentifier com.example.mypasscodepayload PayloadType com.apple.mobiledevice.passwordpolicy PayloadUUID 2a8a75e5-d17d-44d5-b062-3cb92161af9f PayloadVersion 1 PayloadDisplayName Passcode PayloadIdentifier com.example.myprofile PayloadType Configuration PayloadUUID e044f50d-ff67-4bcd-9f3f-d7b678091061 PayloadVersion 1 ## Topics ### Objects - [Passcode.CustomRegex](devicemanagement/passcode/customregex-data.dictionary.md) ## See Also ### Security - [SecurityPreferences](devicemanagement/securitypreferences.md) - [SmartCard](devicemanagement/smartcard.md)