BFU- and AFU-password

HarryB

Hello,

I heard that GrapheneOS uses two types of passwords: a BFU password, which you have to enter when powering on the device or after the auto-reboot timeout, and an AFU password, which you use to unlock the screen throughout the day

I haven't found any settings for this second password anywhere. I always use the same password.

Thanks a lot in advance for any clarification!

PS:
"BFU and AFU passwords are certainly not official terms :)

other8026

HarryB an AFU password, which you use to unlock the screen throughout the day

The secondary unlock method is usually some kind of biometric. For us it's a fingerprint. Maybe you're referring to the two-factor fingerprint unlock where you unlock your device with both your fingerprint and a separate PIN (doesn't have to be the same as the primary unlock PIN)? If so, you can enable that after adding a fingerprint in Settings > Security & privacy > Device unlock > Fingerprint unlock > Second factor PIN.

grayway2

HarryB You are using an unique password/pin to protect your owner profile.

BFU = device is off or password/pin was never used to unlock your profile after device restart

AFU = your device is on, and you already unlocked your profile at least one time

For secondary profiles "ending session" is sufficient to put these profile in BFU. Your owner profile will remain in AFU state until you'll restart or power off your phone.

userofgos

HarryB

BFU & AFU refer to the current state of the device's Filesystem Encryption:

BFU = Before First Unlock ( the state before the pin/passphrase was used to decrypt the user Filesystem, and unlock the device)
AFU = After First Unlock (when the device is in the locked/lockscreen state any time(s) after the pin/passphrase was first used at boot/reboot to decrypt the user Filesystem)