Password and keyguard
DANGER
Use with caution !!!
WearOS
You can only use numeric PIN on WearOS platform. Don't set an alphabetic password, or you can no longer unlock your watch!
Password info
[API29] Current password complexity. Please view Required password complexity
Is password complexity sufficient. If the current password complexity match the required password complexity
Password failed attempts. [Device admin]
[API28] Unified password. true if the work profile and main user use a same password
Reset password token
[Device owner] [Profile owner]
[API26]
Actions:
- Clear token
- Set token (If no password is set, the token will be activated automatically)
- Activate token (Jump to Settings, type your password to activate this token)
The token will remain effective even if the user changes or clears the lockscreen password.
WARNING
This token is highly sensitive and should be treated at the same level as user credentials. In particular, NEVER store this token on device in plaintext.
The token is hardcoded. It is 114514191981011451419198101145141919810
TODO: input token manually
Reset password
Set a new lockscreen password. The length of this password must be at least 4 digits. Keep it empty to remove password
If you set a numeric password that length is 6 or lower, it will set as PIN
Options:
- Do not ask credentials on boot [Device owner]
- Require entry. Don't allow other admins to change the password again until the user has entered it.
Actions:
- [API26] Reset password with token [Device owner] [Profile owner]
- Reset password (Deprecated) (Before API24, Device admin can use it anytime. From API24, Device admin can set a password if no password it set, Device owner and Profile owner can reset password if the device is unlocked. Deprecated from API26)
Screen timeout
[Device admin]
Set the maximum time for user activity until the device will lock. This limits the length that the user can set.
0 means there is no restriction
TODO: update permission
Password expiration timeout
[Device admin]
Restart the countdown for password expiration
0 means there is no restriction
TODO: update permission
Max failed passwords for wipe
[Device admin]
Setting this to a value greater than zero enables a policy that will perform a device or profile wipe after too many incorrect device-unlock passwords have been entered.
When this policy is set on the system or the main user, the device will be factory reset after too many incorrect password attempts. When set on any other user, only the corresponding user or profile will be wiped.
TODO: update permission
Password history length
[Device admin]
Set the length of the password history. After setting this, the user will not be able to enter a new password that is the same as any password in the history. Note that the current password will remain until the user has set a new one, so the change does not take place immediately.
0 means there is no restriction
TODO: update permission
Required strong auth timeout
[Device owner] [Profile owner]
[API26]
Determine for how long the user will be able to use secondary, non strong auth for authentication, since last strong method authentication (password, pin or pattern) was used. After the returned timeout the user is required to use strong authentication method.
A value of 0 means the admin is not participating in controlling the timeout. The minimum and maximum timeouts are platform-defined and are typically 1 hour and 72 hours, respectively.
Required password complexity
[Device owner] [Profile owner]
[API31]
Sets a minimum password complexity requirement for the user's screen lock. The user is unable to set a password with a lower complexity level.
There are 4 levels of password complexity:
- None. No password is required
- Low. Allow pattern and PIN with repeating or ordered sequences
- Medium. PIN with no repeating or ordered sequences, length at least 4
- High. PIN with no repeating or ordered sequences, length at least 8. Alphabetic and alphanumeric, length at least 6
You can jump to Settings to set a new password by click Request to set a new password
Keyguard features
[Device admin]
TODO: update permission
Disable keyguard customizations, such as widgets. After setting this, keyguard features will be disabled according to the provided feature list.
Modes:
- Enable all
- Disable all
- Disable custom features
Custom features:
- Disable widgets (Deprecated)
- Disable camera
- Disable notifications
- Disable un-redacted notifications
- Disable trust agents
- Disable fingerprint unlock
- Disable remote input (Deprecated)
- [API28] Disable face unlock
- [API28] Disable iris unlock
- [API28] Disable biometric unlock
- [API34] Disable shortcuts
Require password quality
[Device owner] [Profile owner]
Deprecated from API31. Please use Required password complexity
Quality levels:
- None
- Must set a password or pattern
- Alphabetic
- Numeric
- Alphanumeric
- Biometrics (weak)
- Numeric (Complex)
- Custom (won't support)