How to Inspect Lockscreen Credentials and Synthetic Passwords on Android Using ADB dumpsys lock_settings

In the Android security architecture, user lockscreen credentials (PIN, pattern, password) are never stored as plain hashes in filesystem storage. Instead, Android implements a multi-tier cryptographic framework centered around the Synthetic Password (SP) architecture, hardware-backed Keystore, Gatekeeper HAL, and Weaver tamper-resistant secure elements. When a user authenticates, the LockSettingsService coordinates with hardware security modules to derive cryptographic master keys that decrypt the user’s Credential-Encrypted (CE) user storage partition. Using the Android Debug Bridge (ADB), security researchers, forensic analysts, and Android platform developers can query dumpsys lock_settings to inspect the state of lockscreen security, synthetic passwords, and hardware token enrollments.

Understanding Android Synthetic Password and LockSettings Architecture

The Synthetic Password (SP) architecture (introduced in Android 8.0 and enhanced in Android 10+) decouples the user’s chosen PIN/password from the actual keys used to encrypt filesystem storage:

• Synthetic Password Generation: When a user initializes their device, Android generates a high-entropy, 512-bit random cryptographic key called the Synthetic Password. The SP is the true master key used to derive encryption keys for the Credential-Encrypted (CE) storage partition.
• SP Blob Protection: The 512-bit SP is split and encrypted using multiple protection layers, including Weaver/Gatekeeper hardware authentication tokens, local hardware keystores, and the user’s PIN/password credential.
• Credential Alteration Without Re-Encryption: When a user changes their PIN from 1234 to 5678, Android does not re-encrypt gigabytes of user data on flash storage. It simply unwraps the Synthetic Password using the old credential and re-wraps it with the new credential, ensuring instantaneous and secure password updates.
• LockSettingsService: The system service (lock_settings) that manages synthetic password blobs, biographical lock states, password quality requirements, and multi-user profile credential handles.

Connecting via ADB and Querying lock_settings

To inspect lockscreen credential storage, establish an authenticated ADB connection with USB Debugging enabled:

# Verify device connectivity
adb devices

# Execute the lock_settings service dump
adb shell dumpsys lock_settings

The resulting output prints active user credential handles, synthetic password enrollment states, and hardware security bindings.

Auditing Synthetic Password State and Credential Handles

Examine the service dump to verify whether Synthetic Password is initialized for active Android profiles:

# Filter output to inspect Synthetic Password enrollment
adb shell dumpsys lock_settings | grep -i -A 10 "SyntheticPassword"

Key indicators reported in the dump include:

• SP Enabled: Confirms whether the device utilizes modern Synthetic Password encryption (should display true on all modern Android devices).
• Credential Handle: A 64-bit unique integer handle referencing the stored SP encrypted blob under /data/system/users/0/spblob/.
• Secure Element / Weaver Slot: Displays the hardware slot allocated on the tamper-resistant Weaver or StrongBox chip that enforces brute-force rate-limiting and wipe counters.

Inspecting Lockscreen Quality and Policy Constraints

To verify the configured credential type (PIN, Pattern, Password) and policy restrictions enforced by enterprise device administration:

# Query lockscreen quality and credential requirements
adb shell dumpsys lock_settings | grep -i -E "quality|type|length"

The output reports standardized credential quality constants defined in Android DevicePolicyManager:

Quality Flag Value	Credential Type	Security Enforcement
0x00000	None (Swipe / Unsecured)	Zero cryptographic credential protection; device unencrypted at rest.
0x10000	Pattern	Requires a 3×3 grid pattern connecting at least 4 nodes.
0x20000	Numeric PIN	Standard numeric PIN with minimum 4-digit requirement.
0x30000	Complex Numeric PIN	Numeric PIN prohibiting sequential (1234) or repeated (1111) numbers.
0x40000 – 0x60000	Alphanumeric Password	High-security complex password requiring letters, numbers, and symbols.

Inspecting Gatekeeper and Biometric Weaver Bindings

When biometric authentication (fingerprint or face unlock) is used, biometrics do not bypass the lockscreen PIN; rather, the biometric HAL returns an authentication token to the Gatekeeper hardware module, which temporarily unwraps an SP escrow token in memory.

# Inspect escrow tokens and hardware gatekeeper handles
adb shell dumpsys lock_settings | grep -i -A 8 "escrow"

If an escrow token is active, it indicates that biometric or Smart Lock authentication is primed to unlock the user session without re-prompting for the root PIN.

Querying Lock Settings Properties via cmd

Android exposes the cmd lock_settings command-line utility in ADB shell to query and manage credential properties for automated testing:

# Query lock settings command help
adb shell cmd lock_settings help

# Check if user 0 has an active lockscreen credential
adb shell cmd lock_settings verify --old "" 0

On non-production developer builds (userdebug or eng), cmd lock_settings set-pin and clear allow automated provisioning scripts to configure or remove test credentials programmatically.

Auditing adb shell dumpsys lock_settings gives security researchers and enterprise administrators complete visibility into user authentication mechanisms, synthetic password protection, and hardware-backed credential storage on Android.