Recover lost iOS Restrictions/ScreenTime PINs from backups in seconds.
Suppors iOS 4 - 11 using Brute-Force attack.
When i was younger I had ScreenTime setup on my iPhone and sometimes it was very annoying. Years later after gaining some exprerience in computers and programming I decided to find a way how to extract the PIN from a phone. I was inspired by this blog post which undercovers how iOS was saving Salt + Target Key (the ingredients to the PIN) in the local iPhone backup files and PinFinder program.
If you want to know more about how this script works, scroll down to: How It Works
Important
Windows users - You can skip these steps below and download executable from Releases tab
- Download and install Python3
- Download this program from GitHub
- Locate the downloaded folder in CMD/Terminal
- Install requirements:
- MacOS:
pip3 install -r requirements.txt - Windows:
pip install -r requirements.txt
- MacOS:
- Run the program
- MacOS:
python3 main.py - Windows:
python main.py
- MacOS:
- Install requirements:
- 🏝️ Easy to use - run the program, select the backup, wait a few seconds, done!
- 🦾 Auto-detect backups - automatically detects and lists all backups from deafult system paths
- 📝 Quick backups overview - iOS version, device name, device type, backup date, backup location
- 💻 Windows/MacOS supported - Multi-platform support
- Add Custom Backup Location option
- Add Popular iOS backup tool location
Note
Explanation text generated by AI based on my code.
iOS stores your Screen Time passcode not as plain text, but as a derived key: the result of running your PIN through a cryptographic function called PBKDF2 (Password-Based Key Derivation Function 2) combined with a random salt value. Think of it like a fingerprint: you can't reverse-engineer the original finger from the fingerprint alone — but if you know the finger, you can check whether it matches.
┌─────────────────────────────────────────────────────┐
│ YOUR IPHONE │
│ │
│ PIN: "1234" ──┐ │
│ ▼ │
│ PBKDF2(PIN + SALT, 1000 iterations) │
│ │ │
│ ▼ │
│ Derived Key: a3f8... (stored in backup .plist) │
│ Salt: 7c2d... (stored in backup .plist) │
└─────────────────────────────────────────────────────┘
When you create an iTunes backup, iOS writes the derived key and the salt into a file called com.apple.restrictionspassword.plist, stored locally on your computer. The salt and derived key live under the XML keys RestrictionsPasswordKey and RestrictionsPasswordSalt.
~/Library/Application Support/MobileSync/Backup/{UDID}/
└── 398bc9c2aeeab4cb0c12ada0f52eea12cf14f40b ← the .plist file
├── RestrictionsPasswordKey (the hash)
└── RestrictionsPasswordSalt (the salt)
Since the PIN is always exactly 4 digits, there are only 10,000 possible combinations (0000–9999). This makes an offline brute-force attack trivial — the tool simply runs all 10,000 candidates through the same PBKDF2 function and checks which one produces a matching derived key.
On iOS 12 and later, the backup must be encrypted (iTunes setting) because Apple moved the passcode into the device keychain, which is only included in encrypted backups.
TIMELINE OF STORAGE METHODS:
iOS 7–11 ──▶ Plain PBKDF2 hash in unencrypted backup ✅ (easy)
iOS 12 ──▶ Hash in Keychain → only in ENCRYPTED backup ⚠️
iOS 13+ ──▶ Tied to Apple ID / iCloud → no local hash ❌
Found a bug or issue? Open a new issue in the Issues tab or create a fork of this repo.
PinFinder - inspiring me to create this program in first place
This blog post for detailed explanation how this method works and how to recreate PIN extraction.
turdus merula tool I was able downgrade my iPhone 7 (A10) to previous unsigned iOS versions to develop my program.
Made with 💖 by asisamko