The default setting for an iPhone passcode is only numerical. Simple iPhone passwords, more often than not, are simply more about speed and convenience than they are actual security. But what if you really want to be safe? You should probably set your iPhone to allow an alphanumeric password.
Apple has implemented a couple layers of protection for 6-digit and even the old 4-digit passcodes - time delays, and an optional erasure included, but simple brute-force (trying every possible number combination) hacking of iPhone passcodes are a trivial exercise for people (law enforcement or hackers) with the patience and right equipment to do so. A real world example of just how easy it is to brute force an iPhone is the case in San Bernadino, where the F.B.I paid a hacker to hack the iPhone of gunman Syed Farook.
10 possible values (0–9), raised to the power of 4 digits: 10000 possible 4-digit passcodes.
This box can crack your 4-digit passcode in about 4.5 days:
http://www.popsci.com.au/tech/computing/this-box-can-figure-out-your-4digit-iphone-passcode,401857
What if you could set your iPhone to use an alphanumeric password? This greatly increases the time, energy and difficulty it would take to brute force an iPhone passcode, as not only would the attacker need to sequence every single number combination, they would also have to account for the entire alphabet AND number system, and then every single possible permutation. This takes a loong time...
7-digit passcodes will take up to 9.2 days, and on average 4.6 days, to crack
8-digit passcodes will take up to three months, and on average 46 days, to crack
9-digit passcodes will take up to 2.5 years, and on average 1.2 years, to crack
10-digit passcodes will take up to 25 years, and on average 12.6 years, to crack
11-digit passcodes will take up to 253 years, and on average 127 years, to crack
12-digit passcodes will take up to 2,536 years, and on average 1,268 years, to crack
13-digit passcodes will take up to 25,367 years, and on average 12,683 years, to crack
It probably does not have to as long as this, but hey, the longer, the better ;-)
