Locked myself out: Possible bug when updating PIN?

PaulSibber24

Hello everybody and thank you in advance for reading my lengthy report.

I started using GOS in May 2025 with a brand new Pixel 9 Pro in Germany. I am writing this in quite some distress as I did not create a backup of my pictures taken since May and the prospect of losing all of them is a depressing thought. Although I have to measure myself to my own motto "no backup, no sympathy".

Prerequisite: I set up GOS in May 2025 on a new Pixel 9 Pro, set my PIN to a four digit number and activated finger prints

What happened: Because of a possible privacy breach on Friday 17th of October I deactivated the finger prints. Changed the four digit PIN to a five digit PIN. As I never used this number before I can make it public in case this helps. Immediately after changing the number I pressed the power button to log out. To ease my paranoia I typed the new PIN and found myself confronted with a Wrong PIN message. I panic and tried the number again. As it still did not work I tried the old PIN which also did not work anymore. I tried some more numbers that I thought could be variations of what the originally intended number was without any luck.

At first I thought I really just forgot the number or mistyped when entering it in the first place. But the more I think about it the less convinced I am that this is the case. First of all, IIRC one has to enter the new PIN twice for confirmation. If I mistyped, the same error also had to happen twice which seems unlikely as the number pad is well spaced and mistyping seems less likely than with the regular qwerty keyboard. Secondly I took the new number from a bottle I found standing around, so it was not randomly 'generated' by myself. I tested it immediately after setting it up without looking at the bottle again. Which means it was very present in my mind right before setup and immediately after the failed confirmation.

I set up a list of possible typing error, variations and reverse versions. Non of them worked until now.

After panicing and trying about ten numbers I stopped and decided to postpone any more tries to the next day. The interval at the time was already quite high. Next day I checked the table of the retry delays and found it to be way slower progressing than what I am experiencing with my phone. The current display of the retry interval is 128.972 seconds which is impossible according to the table which states a maximum interval of once per day. Also the actual interval is shorter. I am currently at at least two retries a day when I shut down the device and reboot after a couple of hours.

All of this leads to a suspicion that I am not facing (although still very possible) my own incapability to remember a code for 30 seconds but a possible technical problem. Is anyone here able to check the code behind the mechanism or test if a code change from XYZY to ABACD after a long period of usage (5 Months) might cause problems with the re-login? I know this is a straw and I hope no one finds this offensive. I understand everyone who thinks I am just and idiot. I feel the same.

So any help is appreciated, and I will give any additional info I have. The phone was running the latest version and is regularly rebooted to auto install updates. I am on the regular release channel but I do not know the current version number.

Thank you all and best regards
Paul

GrouchyGrape

PaulSibber24 while it's always possible for there to be a "bug", I can all but guarantee this is user error, unfortunately.

I will say this, any attempts you made during a waiting period by simply rebooting the phone to "bypass" the wait were not actual attempts. It looks like the lock screen is allowing an attempt but the throttling is still active and it rejects anything you put in, including the correct pin.

My guess is you either misread the numbers and entered something else or fat fingered the initial input. It happens to the best of us. I do really wish we could peek at the password/pin being entered to ensure it's correct.

PaulSibber24

I agree to the fact that it is very likely user error and I have to try as long as I can before giving up.

But the other thing you mentioned seems weird. Let's say I have one attempt and it's stating Enter PIN, I have a try and get a 'Wrong PIN next try in X seconds'. (Sorry wording is off, language is set to German). If I reboot now this period remains and I have no attempt. But if I reboot after let's say 10 hours I have a new try. This is on one hand plausible as I believe to be in a tier of around 50-60 attempts. On the other hand it does not fit with the stated seconds. If I try now (I currently have an attempt) I get 130.557 Seconds remaining. This does not make sense as it way above the maximum time of 86400 (one day) and I am sure I have not reached that many attempts yet.

If I understand you correctly you tell me the stated time is maybe right and I get phantom attempts? This would be catastrophic as it would mean I have to retry everything I did until now.

So my main question at the moment is why is the time higher than the real interval (or is it)? And why is it above the maximum stated in the FAQ.

GrouchyGrape

PaulSibber24 unfortunately, you will have to start again if you're determined to get in without a factory reset. Unless I'm mistaken, the "fake" unlock attempts after a reboot is still an active bug.

I'm not sure about the timer, but I believe @Lucario1829 is correct, and the website needs updating. I could be wrong, though.

Lucario1829

i believe i heard the maximum throttling time listed on the gos website is actually currently incorrect and it can go higher than that, and yes, it is a known thing that occassionally if you reboot after a bit (but not the amount of time it stated) itll give you a fake pin attempt thatll reject even the correct password. sorry

PaulSibber24

Both are absolute shit bugs tbh if true. Thanks for the heads up.
But still, I am not remotely close to the amount necessary for the stated time. I hate this so much...

GrouchyGrape

PaulSibber24 I understand how frustrating that is.. I don't believe any of the bugs discussed are GOS specific.

If nothing else, you'll learn a painful yet valuable lesson of the importance of backups...

I treat my phone with the assumption that it could break, be lost, stolen, confiscated, etc. at any moment in time, so you better believe I test my backups thoroughly.

PaulSibber24

I agree and rest assured, I will never have this problem again. But still, I do not give up my hope. It's just so frustrating if the mechanism is broken. Do I start all over? What interval is safe?

GrouchyGrape

PaulSibber24 personally, I would start over if the data is that important. Write down what you think the pin is, then derivations of that which seem most likely to accidentally enter. I do believe I've read from a few sources that the max delay is once per day, but can't confirm.

Do you have auto reboot enabled?

PaulSibber24

This is so messed up. I slowed my attempts down to less than once a day and the time keeps increasing with each attempt. I am now at a stated interval of 393.638 seconds which equals 4 and a half day! But after some time (half a day?) the counter disappears and I am able to retry without a reboot... Are these attempts valid or not??

cloerr

Hi, I had the same access issue: I used my password - a mix of letters, numbers, symbols, and spaces - on my phone for over 8 months, and one day I realized I could no longer get into the system. It's hard to say whether it was a system glitch or just human error (which isn't out of the question), since at the time I was swamped with a project, hadn't had a proper night's sleep for over two weeks - only 4 hours a night - and it's entirely possible I just forgot it. The most interesting part: when these moments happen, you can mistakenly "write down" a different password in your head and convince yourself it's the right one, then doubt yourself over and over, ultimately reducing your chances of success even further. It was tough to come to terms with the fact that I'd lost data accumulated over those 8 months, passwords, seed phrases for wallets, and also that all my accounts relied solely on ProtonMail with keys but no backup emails or phone numbers, meaning without the keys, there's no way to recover access to the email, and worst of all - and stupidest - the lack of any backups. You can check out my profile and read my first post.

In your situation, it really looks like purely human error. You should just let this go and move on: life is short enough as it is without obsessing over one thing. You can give yourself one final shot at trying - I'll be glad if you manage to unlock it. For the future, come up with a password and only after a long time, once you're confident you've memorized it, then set it and use it; you can also temporarily jot it down in small print on a scrap of paper and hide it securely, if your threat model allows for that. I use Google Translate.

PaulSibber24

H iCloerr, I understand your sentiment and I agree. Thank you for your words!
In fact I already moved on. I bought a new phone, I restored all available data, I set up a complex backup scheme and my keys are now safe. The "old" phone is now purely purposed as a locked vault with my pictures and I will try until I get bored.
My remaining point here is I hope to get an affirmation that there are bugs in the mechanism which might render my attempts useless anyway, make me stop trying and might help someone in the future.