[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"stats-overview":3,"kb-article-can-my-password-be-bypassed":10},{"officers":4,"forces":5,"courts":6,"prisons":7,"hearings":8,"legals":9},769,50,224,120,41,11437,{"id":11,"slug":12,"name":13,"content":14,"category_id":15,"source":16,"source_url":16,"source_ref":16,"licence":16,"sort_order":17,"published":18,"created_at":19,"updated_at":20,"category":21,"category_icon":22,"category_slug":23,"excerpt":24,"word_count":25,"reading_time":26,"is_official":27,"related":28,"previous":16,"next":64},"23","can-my-password-be-bypassed","Can the police get into my phone without my password?","Often, yes. Police digital forensics units use commercial tools (the best known are made by Cellebrite, Magnet Forensics and Grayshift) that can extract data from many phones without the passcode. How much they can get depends on the device, its software version, and how it was locked.\n\nWhat tends to be weak\n\n- Short numeric PINs and swipe patterns. A 4-digit PIN has 10,000 combinations and a 6-digit PIN a million; forensic tools can try these automatically on many devices, and some can bypass the delay that normally slows repeated attempts.\n- Devices that are out of date. Older Android phones that no longer receive security updates, and older iPhones, have known vulnerabilities that extraction tools exploit.\n- Rooted or jailbroken devices, unless carefully configured.\n- Devices seized while switched on and recently unlocked, which may be in a state where more data is accessible than after a restart.\n- Cloud backups. Even if the handset resists, data may be obtained from Apple, Google or app providers with the right legal process.\n\nWhat tends to be strong\n\n- A long alphanumeric passcode (letters, numbers and symbols, no obvious words or repetition) combined with full-disk encryption. Modern iPhones and most recent Android phones are encrypted by default, but encryption is only as strong as the passcode protecting the key.\n- Fully updated software. Both iOS and Android now restart or re-lock after periods of inactivity precisely to defeat extraction tools.\n- Hardware-backed security (Apple's Secure Enclave, Android's Titan and similar chips), which limits brute-force attempts.\n- Face and fingerprint unlock are convenient, and are hard to forge, but they can be used against you if you are compelled or tricked into looking at the device. Both platforms let you quickly disable biometrics (for example, by pressing the power button repeatedly), after which the passcode is required.\n\nPulling memory chips off the board (\"chip-off\") still happens with older devices, but on an encrypted phone it produces encrypted data and little else.\n\nThe legal side\n\n- The police do not need your permission to attempt to access a device they have lawfully seized. Section 20 of PACE lets them require information held on a computer to be produced in a readable form, and they can examine the device itself.\n- You generally cannot be forced to hand over a passcode unless a notice is served under section 49 of the Regulation of Investigatory Powers Act 2000, which needs judicial authorisation and carries a prison sentence for non-compliance. See our Section 49 guide.\n- Deliberately wiping or destroying a device after you know it is wanted as evidence can be perverting the course of justice, which is a serious offence. Securing your data in advance is lawful; destroying evidence is not.\n\nWhy this matters for everyone\n\nGood device security protects you from thieves and fraudsters as much as from anyone else. A long passcode, up-to-date software, and knowing how to disable biometrics quickly are sensible habits regardless of whether you ever meet the police.\n\nThis is general information for England and Wales, not legal advice. If you have been arrested or charged, speak to a solicitor: advice at the police station is free for everyone.","5",null,0,true,"2022-11-03T03:13:05.000Z","2026-10-06T09:14:18.000Z","CyberCrime","mdi:shield-lock","cybercrime","Often, yes. Police digital forensics units use commercial tools (the best known are made by Cellebrite, Magnet Forensics and Grayshift) that can extract data…",531,3,false,[29,35,42,55],{"id":30,"slug":31,"name":32,"source":16,"source_url":16,"sort_order":17,"category":21,"category_icon":22,"category_slug":23,"excerpt":33,"word_count":34,"reading_time":26,"is_official":27},"8","do-i-have-to-give-the-police-my-password","Do I have to give the police my password?","Not unless they serve a formal notice under section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA), or you are being examined at a port or…",591,{"id":36,"slug":37,"name":38,"source":16,"source_url":16,"sort_order":17,"category":21,"category_icon":22,"category_slug":23,"excerpt":39,"word_count":40,"reading_time":41,"is_official":27},"9","how-are-digital-devices-seized","How the police seize phones, laptops and other devices","Digital devices are now evidence in most investigations, so the police move quickly to secure them before data can be deleted. This is what the law allows…",643,4,{"id":43,"slug":44,"name":45,"source":46,"source_url":47,"sort_order":48,"category":49,"category_icon":50,"category_slug":51,"excerpt":52,"word_count":53,"reading_time":54,"is_official":18},"34","pace-code-c-how-long-can-police-detain-you","How long can the police hold you without charge?","PACE Code C (2019) \u002F PACE 1984","https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fpublications\u002Fpace-code-c-2019",20,"PACE Code C – Detention & Questioning","mdi:handcuffs","pace-code-c-detention-and-questioning","There are limits on how long the police can hold you before they must either charge you or release you. As a general rule, the police can detain you for up…",189,1,{"id":56,"slug":57,"name":58,"source":16,"source_url":16,"sort_order":17,"category":59,"category_icon":60,"category_slug":61,"excerpt":62,"word_count":63,"reading_time":26,"is_official":27},"16","section-49","Section 49 RIPA notices: being ordered to hand over a password","Sections","mdi:format-section","sections","Section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA) is the power that turns a request for your password into a legal order. It is used…",544,{"slug":31,"name":32}]