Face ID and a passcode look like two locks on the same door. They are not. The passcode is the master key and Face ID is a convenience layer over it, and understanding which one is doing what changes how you set the phone up.
Here is where each one actually matters.
The passcode is the real key
Face ID is a way to avoid typing the passcode. It is not a separate credential, and anything Face ID unlocks, the passcode also unlocks.
That is the single most important thing to understand about iPhone security, and it explains most of the advice that follows. Someone who knows your passcode has your phone, regardless of how well Face ID is configured.
It also explains why a four-digit passcode is worse than it sounds. It is not a weak second layer, it is a weak master key.
Where Face ID is genuinely better
Not because it is harder to defeat, but because of when it is used.
In public. A passcode typed in a bar, on a train or at a counter can be watched. A face cannot be shoulder-surfed. This is the largest real-world benefit and it is about observation rather than cryptography.
For sensitive actions with Stolen Device Protection on. With that feature enabled, viewing saved passwords, using stored payment details and changing account settings require biometrics with no passcode fallback. Here Face ID genuinely is a separate layer, and it is the only situation where it is.
For app locks. Individual apps can be set to require Face ID each time they open, which is a different question from unlocking the phone.
Where the passcode is what matters
Length and type. Six digits is the current default. Four is a holdover from older setups and worth changing. A custom alphanumeric code, under Passcode Options, is better still and you type it less often than you expect, because Face ID handles the routine unlocks.
After a restart. The phone always requires the passcode after being powered on, before Face ID becomes available. Same after several failed scans and after a period without use.
When your face does not work. Masks, sunglasses, bad light, an awkward angle, a wet face. The passcode is the fallback, and it will be used more often than people expect.
Set up a second appearance
This is the setting that fixes most Face ID complaints and almost nobody knows it exists. Under Settings, Face ID and Passcode, Set Up an Alternate Appearance lets you register a second scan. It is meant for a significantly different look, and in practice it is best used to capture yourself the way you often are but were not when you first set it up: glasses on if you scanned without them, hair up if you usually scan with it down, in the lower light of a bedside table rather than the bright room where you set the phone up. If Face ID fails for you several times a day, this is almost certainly why, and it takes thirty seconds.
Attention detection, and why to leave it on
By default, Face ID requires your eyes to be open and looking at the phone. That prevents the phone being unlocked while you are asleep or not paying attention.
It can be turned off under Settings, Face ID and Passcode, Require Attention for Face ID, and it is occasionally suggested as a fix for unreliable scanning. Turning it off makes the phone meaningfully easier to unlock without your cooperation, and it should be the last thing you try rather than the first.
The same setting controls whether the phone keeps the screen lit while you are looking at it and whether it lowers notification alert volume when it can see you are attending.
The lock screen shortcuts you already allowed
Worth reading once while you are in this settings screen, because it is a list most people have never opened and it governs what works without any authentication at all.
Under Settings, Face ID and Passcode, scroll to Allow Access When Locked. Every switch there is something reachable from a locked phone. Today View and Search, Notification Centre, Control Centre, Siri, Reply with Message, Home Control, Wallet, Return Missed Calls, and USB Accessories.
None of them is dangerous on its own and each is a small opening. Control Centre lets someone put the phone in Aeroplane Mode, which stops it reporting its location. Reply with Message lets someone answer an incoming message from your number without unlocking. Siri can answer some questions about your data depending on configuration.
The two most worth turning off for most people are Control Centre, because of the Aeroplane Mode point, and Reply with Message. The rest depend on how you use the phone. Turning all of them off is available and generally more inconvenience than it is worth.
What to actually do
Four things, in order.
Change a four-digit passcode to six digits or an alphanumeric code. Set up an alternate appearance. Turn on Stolen Device Protection, which is what makes Face ID a real second layer. And set notification previews to When Unlocked, under Settings, Notifications.
None of them takes more than a minute and together they change what someone can do with the phone if they have it.
Quick answers
Can I use Face ID with a mask?
Recent iOS versions support Face ID with a mask if you enable it during setup, at some cost to accuracy. An alternate appearance registered with a mask on also helps.
Does a longer passcode slow down unlocking?
Barely, because you rarely type it. Face ID handles most unlocks and the passcode appears mainly after a restart.
Is Touch ID weaker than Face ID?
Different rather than weaker, and both sit above the same passcode. Touch ID is more reliable with a mask and less reliable with wet hands.
What happens after too many failed passcode attempts?
The phone imposes increasing delays, and if Erase Data is enabled in the same settings screen it wipes after ten failures. That setting is a real trade-off worth deciding deliberately.
Where to get it
With the settings sorted, the lock screen is a free choice again. DON'T Touch Phone Wallpapers has warning and contact-line designs in HD, previewed in a phone-shaped frame before you save.
If you only do one thing: change a four-digit passcode. Everything else is built on top of it.