This article summarises all of the options for recovering Screen Time or restrictions passcodes on every version of iOS. For users who have lost or forgotten their Screen Time passcodes, it describes an easy process for automated recovery, a summary of Apple's advice, and guided steps on how to reset or recover the passcodes for free.
Support for automatic recovery or removal of the Screen Time passcode is built-in to iPhone Backup Extractor for every version of iOS.
|13||Screen Time||Code removal|
|12||Screen Time||Code recovery|
|7‒11||Parental restrictions||Code recovery|
|5‒6||Parental restrictions||Code reset to
|1‒4||Parental restrictions||Code recovery|
The process will disable Screen Time on an iOS device (and, optionally, on every other iOS device and Mac on the same Apple ID). It will also reset the password, so if Screen Time is re-enabled, you'll be prompted to choose a new passcode.
The screenshots here describe the process for iOS 13, but steps 1 through 3 will trigger the appropriate process for any earlier version of iOS, too.
Download and install iPhone Backup Extractor (works on Windows & Mac), then open it.
Connect your iPhone or iPad with a USB cable, and select it from iPhone Backup Extractor's left-hand menu.
Choose the "Utilities" tab and click "Screen Time recovery". That'll open a wizard, prompting you with the next steps.
The wizard will prompt you to temporarily disable Apple's "Find My" service on your iPhone, in
[iCloud account name]→
Find my iPhone. You'll need your Apple ID password to do this. Once the process has completed, you'll be able to re-enable it. (Note there's no need to remove your device from your iCloud account.)
Click the "Let's start" button. After a short while your phone will restart, and once it completes your phone will no longer have a Screen Time passcode enabled.
Here's a video showing the phone completing its restart. As it restarts it also disables Screen Time on their Mac, too.
With that, you're all done. Don't forget to re-enable "Find My" in your device's Settings menu.
Apple's advice on recovering from a lost Screen Time passcode is to erase and reset the device, starting afresh with a new set of data. They write:
Make sure to choose a passcode that's different from the passcode you use to unlock your device. If you can't remember a restrictions passcode that you set on a previous version of iOS or iPadOS, or you forgot your Screen Time passcode, you need to erase your device, then set it up as a new device to remove the passcode. Restoring your device from a backup won't remove your passcode.
Strictly speaking this isn't entirely accurate: restoring from a backup will remove the passcode, if the backup was taken before the passcode was applied and "Share across devices" wasn't enabled in the Screen Time settings.
Geniuses at some Apple Stores may recommend iPhone Backup Extractor, but Apple's Twitter support team always recommend a reset. This approach will work, but it will result in loss of all of a user's data, and needing to set their iPhone or iPad up again from scratch.
We've seen some devices running iOS 13.3 prompt users to provide an Apple ID when Screen Time is enabled, in order to let them automatically recover their Screen Time passcode if lost. iOS will prompt you, saying "if you do not provide an Apple ID, you will be unable to change Screen Time settings without entering the passcode".
This can be found under
Screen Time →
Use Screen Time passcode.
Assuming this option was used when adding the Screen Time passcode, it'll be available for users with forgotten Screen Time passcodes. A prompt will appear when the user chooses to disable Screen Time, using
Screen Time →
Turn Off Screen Time, or
Screen Time →
Change Screen Time Passcode →
Turn Off Screen Time Passcode.
Ensure you have recent encrypted iPhone backup.
Before proceeding, turn off “Find my iPhone” in
[iCloud account name]→
Find my iPhone
Connect the phone to iTunes with its USB cable, and click "Restore iPhone...". This will trigger iTunes to download the latest firmware for your phone, before erasing it and updating it. It is really important you have a backup before doing this.
iTunes will double-check you've got a recent backup:
Once the firmware upgrade has completed, iTunes will ask you to choose a backup to restore from. Select the backup you made earlier and restore it. Once it is restored, you phone will be how it was -- but without the Screen Time passcode.
In iOS 12, Apple stores the Screen Time passcode in the user's keychain. The passcode is stored in a device-specific part of the keychain, which means it won't be synchronised with a user's other Apple devices, and thus can't be accessed through them. Whilst iPhone Backup Extractor makes the process of recovering this passcode easy, describing how to manually decrypt and extract a device keychain is particularly complex.
For users seeking a manual route, we'd recommend following the advice for iOS 13, and restoring a backup.
iOS versions 7 to 11 store and the restrictions passcode in backups, hashed using the
PBKDF2 algorithm. This requires some unscrambling. To get to this hash, you'll need to extract the
com.apple.restrictionspassword.plist file from a backup of the device. The file can be found (at no cost) using iPhone Backup Extractor's "Expert mode" in
Home Domain →
Preferences, or by manually decrypting the raw
Once you've got it, look for these values:
<key>RestrictionsPasswordKey</key> <data>...</data> <key>RestrictionsPasswordSalt</key> <data>...</data>
The key and salt are derived from the user's passcode with
PBKDF2, and are relatively easy to unscramble with brute force. The restrictions passcode is only 4 digits in these versions of iOS, so there are only 10,000 combinations to try.
Use the instructions below to reset the restrictions PIN to
1234 on an iPad or an iPhone. If you decided to reset your passcode using this method, these are the steps you need to follow:
Create a backup in iTunes while your restrictions passcode is enabled. Because we're doing this by hand, it's a lot easier if the backup isn't unencrypted. (It's better to keep your backup encrypted and use the automated method earlier in this guide.)
Browse to the default backup folder (usually
C:\Users\[username]\AppData\Roaming\Apple Computer\MobileSync\Backup\on Windows or
~/Library/Application Support/MobileSyncon macOS). You could also run iPhone Backup Extractor and right-click on your backup before choosing "Show in Finder" or "Open in Explorer" to open your backup's folder.
Take a backup copy of the file
662bc19b13aecef58a7e855d0316e4cf61e2642bas this is the one we'll be editing -- and you want a backup copy in case anything goes wrong...
Use an online SHA-1 hash generator to take a hash of the file
662bc19b13aecef58a7e855d0316e4cf61e2642b- make a note of this hash (it will be something like
a6533d4dc9ac9f8af7ba65cb955187f025cfde8b, though it will be different for each backup).
662bc19b13aecef58a7e855d0316e4cf61e2642bfile with iPhone Backup Extractor's Plist editor. Click on
View / Edit Plistfrom the
Filemenu and browse for your
Search in the file to make sure there isn't already a line with the text
<key>SBParentalControlsPIN</key>. If there is, then the line beneath it (which will read something like
<string>1234</string>) contains the PIN.
If the line doesn't exist (which it shouldn't on iOS5 or 6 backups) then search for the line
<key>SBParentalControlsEnabled</key>. Below that will be a line saying
<true/>which indicates that parental controls are turned on. If the line is missing or says
<false/>then parental controls are not enabled -- and changing the PIN won't help.
<true/>, click on "Edit" and add the following two lines just below the
So the text in the file reads something like this:
Save the amended
662bc19b13aecef58a7e855d0316e4cf61e2642bfile, overwriting the old one.
Use the SHA-1 hash generator to make another hash of the
662bc19b13aecef58a7e855d0316e4cf61e2642bfile, and make a note of this.
Take a safe backup copy of the
Manifest.mbdbfile, as we'll now be editing this file.
Manifest.mbdbin a hex editor like HxD (free) (or TextPad running in hex mode).
Search for the original SHA1 hash you took in step #4 (make sure you're searching in hex mode and not text mode). It’s saying
com.apple.springboard.plistor similar - that’s the right bit of text you’re looking for.
Now the tricky bit - you need to overwrite the old hex value with the new one (that you discovered in step #10). In most hex editors you do this by typing over the old value.
For example, you may see something like this:
72 64 2E 70 6C 69 73 74 FF FF 00 14 38 F1 2D 84 14 0D 32 E3 6E DF D7 62 3F D1 7A 10 11 66 14 70.
Let's assume the hex you are wanting to change is
38F12D84140D32E36EDFand you're needing to change it to
The first thing you'd do is find the beginning of the old hex string and then you'd type over the old hex code to end up with something like this:
72 64 2E 70 6C 69 73 74 FF FF 00 14 12 34 56 78 90 AB CD EF 12 34 D7 62 3F D1 7A 10 11 66 14 70.
Save the edited
Restore the backup to the iPhone using iTunes - make sure you replace the
662bc19b13aecef58a7e855d0316e4cf61e2642bfiles with the modified ones before restoring, if you didn't save them directly into the backup folder after editing them.
Once the phone has restarted at the end of the restore you can now use the PIN
1234to access the parental controls. Hurrah! 🎉
Drop us a note if you found this guide helpful, or leave a comment if we can help further. Happy passcode recovery! 😀