Majority of California based companies employee English only or English and Spanish speakers possibly with some Indian language as well. This leads to lots of problems when you are bilingual or bilingual in other languages such as German in French. Neither Apple nor Microsoft under this sort of language swapping well. Never mind rarer languages like Czech or Greek.
after Apple removed a character from its Czech keyboard
I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"?
In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!"
Now one of the ways in might be those companies who claim to be able to break iPhone security for law enforcement and the like, but I'm not sure if they'd be willing to do it (at any price) unless you could somehow trick them into thinking you had some "interesting" data on there...
It’s wild that "verify existing passcodes remain inputtable" isn't the absolute first item on the QA checklist for any keyboard layout change. The Czech layout isn't exactly an obscure edge case.
The USB keyboard suggestion mentioned in the other comments likely won't work either because of USB Restricted Mode. After an hour of being locked, iOS disables data over the Lightning/USB-C port until the device is unlocked. It’s a perfect, recursive failure: you can't unlock the phone because the character is missing, and you can't plug in a hardware keyboard because the phone is locked.
Treating the passcode keyboard as a transient UI element that can be "cleaned up" rather than a hard security dependency is a massive architectural oversight. If the OS allows a character to be used in a passcode, that glyph needs to be permanently accessible in a fallback mode, no matter what the localization team decides to prune.
I agree with you and don't really get what Apple gets from removing a valid Czech character, but how would you test if all existing passcodes remain inputable without knowing the passcodes of all iPhone users?
The one way to do this that I could see is to include both the new keyboard and the old one and if someone fails to unlock with the new one auto report that to Apple (not the code, just that the unlock failed and that the keyboard might be the problem), then auto revert to the old keyboard on the next unlock attempt...
Phased roll-out. You first introduce a version that still accepts all extant inputs but will actively warn that there are characters that will be removed in a future release.
Then you wait. Then you roll out a version where the new functionality is flipped on by default, but where you still allow to explicitly toggle to the old one. Then you wait some more.
And then - only then - you roll out a release where the old functionality has been removed entirely.
Meh, I think you keep the old keyboard and set a password expiry. New passwords use the new keyboard. Or, if you're in a rush to remove the old code, _after_ next login you require password replacement and use the new onscreen keyboard from then.
Probably the better solution is to include some kind of special lock-screen keyboard that provides some fallback mechanism to input any character. Presumably there are similar edge cases where someone creates a password using one keyboard, then switches keyboard layout, and now can't re-enter it using the active layout...
> During in-house testing, which involved taking an iPhone 16 from iOS 18.5 to iOS 26.4.1, The Register found that Apple has kept the háček in the Czech keyboard, but removed the ability to use it in a custom alphanumeric passcode. The OS will not allow users to input the háček as a character. The key's animation triggers, as does the keyboard's key-tap sound, but the character is not entered into the string.
Sounds more like an actual bug than a decision to change the keyboard layout, if this happens only in the passcode screen?
I think the biggest lesson here is to back up. The reason for losing access to the phone is amazingly dumb but it could have fallen down the stairs for basically the same effect.
And do your could backups cross-provider. You never know what the "big players" are going to pull, and your lifetime customer value is less than the cost of a single support call.
This is exactly the reason why I keep all my shit on an SD card despite Google deliberately making the external storage experience as painful as possible: slow access, broken writes, failed unmounts, no filesystem repair. Literally every time I restart my phone I need to put the card to my PC and repair the filesystem. Also, same card works extremely well when plugged into PC via random cheap USB card reader.
On PCs you still have Linux that resists enshittification and you can pick your own hardware, but it's a really sad state of affairs that there is literally no meaningful mobile system that isn't actively hostile to the user.
The side of my brain that manages organizational changes wonders: how does Apple, a 50 year old company of tens of thousands of engineers and over a trillion USD market cap, manage to keep feature velocity high while not making more of these types of errors?
The bug seems low likelihood but high severity for the few affected users. Other than simply never changing the login keyboard (or any of the keyboard code) or having nearly 100% test coverage, how does a company not accidentally have more of these types of issues?
They do. It’s just that the people using these devices won’t go public with it. I’ve seen so many bizarre bugs in my own experience but I’ve gotten zero articles on them by popular tech journals.
I used to have an emoji password for my Android phone, and had the exact same issue after a reset! It's an odd but pretty terrible failure mode for locking oneself out...
You say locking oneself out, but I decline to consider any situation where a password can be set but not later entered as one where the user bears even a modicum of fault.
As a non-English speaker I can really relate to this. I think the real mistake was Apple allowing to enter a non-ASCII password in the first place. E.g. on macOS the password fields have been locked to English character set, and I'm not sure why it changed on iOS.
Regardless, why should a Vietnamese person be forced to restrict their password to ASCII? If you want to sell your devices in a country, the least you can do is to adopt to the local market. I get that Western cultural dominance makes this hard for some, but I think it should be the bare minimum.
You can use emojis as passwords, do you think that's a good idea? They work now, there's a good chance that they won't be the same forever. See what happened to the family emojis
In my password, I have the Collectivity of Saint Martin flag emoji and United States Minor Outlying Islands flag emoji next to the French flag emoji and US flag emoji. For good measure, also the flag of Chad next to the flag of Romania. I am sure it's not going to cause any issues.
I think there's a distinction to be made between 'is it a good idea for someone informed enough to know how these things go in the real world?' i.e. the HN audience and 'should this be a real worry in a sane world?' to which I say no, it shouldn't be a worry that if I was allowed to enter a password today I may not be able to tomorrow.
That's just excuses for moronic decisions of trillion dollar companies.
Passwords are more secure if they are higher entropy, so it makes sense to support a larger variety of characters, Czech or emoji.
It seems paramount that the OS should not allow password input of any characters which it theater takes away. At the very minimum if this is absolutely necessary to make this breaking change, the user should be warned several times that a character in the password is no longer valid and maybe even prevent the OS from upgrading before the password is changed to a forward-compatible one.
Well, alphabets change (especially emojis), rules change, etc, so keeping a single subset of stable and known characters is unlikely to be a bad idea :)
If you remember what was the encodings situation before UTF-8 became the norm... Let's say it was really ugly. E.g. there were at least two popular encodings for Russian Cyrillic letters — CP1251 and KOI8-R, and it was _very_ common for applications getting it wrong. Restricting things like passwords (and ideally even file names) to ASCII this was a practical necessity rather than an inconvenience.
Well yes, but you can process all passwords as UTF-8, as most of strings are in mac/iOS anyways, to avoid these problems. Then just don’t break an established standard like the keyboard layout. Is that too much to ask for in 2026?
Even if he did have a Mac with the continuity feature enabled, I suppose the lock-screen won’t accept a paste from the clipboard of a Mac.
(If it did, he could enter the correct passcode in any text editor on his Mac, copy it to the clipboard on the Mac, then paste it into the lock-screen on his iPhone)
This really reads like a modern Ancient-Greek story about inscrutable gods who suddenly decide to complicate your life for some unclear reason and don't respond to any prayers and rituals.
People are afraid of AI, but human organizations can be quite opaque as well.
That said, as a Czech, I wouldn't use any accentuated characters in my passwords. Anything beyond 7-bit ASCII is just asking for trouble.
there was a time when I used a simple "§" in my password. turned out, some Android keyboards don't have the "§". Since then I play it safe with my passwords, using only characters I don't need a specialized keyboard for
I assume you can use a physical keyboard on an iPhone like I can on Android via USB? Presumably you could buy a wired Czech keyboard to access the device?
Twice I have had the touchscreen fail on Android devices and been able to get what I needed off them using a USB mouse.
For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
It’s an annoying workaround, but could he connect a USB keyboard (via a USB to lightning adapter) with the ability to enter the character? Does the passcode screen accept input from attached keyboards?
> For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
Well I only use alphanumeric US keyboard standards ever since I found out, that certain characters unique to a language different from yours causes you lock out or massive headaches on a used keyboard with almost no print ink left on the keyboard in a Internet cafe in an other country around 2002.
Be aware of characters not passwords. I feel bad for the guy but not really blame Apple here.
English is my second language and ANSI etc is following a basic character usage. Everything must boil down to 0 and 1 in the end or American English.
It is a de facto standard and maybe knowing about it is as crucial as recognizing the difference between the imperial and metric system before heading for the moon. It is a life saver.
I agree with the recommendation, but it's absurd to not blame Apple here. There is absolutely nothing acceptable about what Apple did in this case, it's a major fuck-up to break password input in this way, and for no reason whatsoever.
Majority of California based companies employee English only or English and Spanish speakers possibly with some Indian language as well. This leads to lots of problems when you are bilingual or bilingual in other languages such as German in French. Neither Apple nor Microsoft under this sort of language swapping well. Never mind rarer languages like Czech or Greek.
after Apple removed a character from its Czech keyboard
I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"?
In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!"
Now one of the ways in might be those companies who claim to be able to break iPhone security for law enforcement and the like, but I'm not sure if they'd be willing to do it (at any price) unless you could somehow trick them into thinking you had some "interesting" data on there...
It’s wild that "verify existing passcodes remain inputtable" isn't the absolute first item on the QA checklist for any keyboard layout change. The Czech layout isn't exactly an obscure edge case.
The USB keyboard suggestion mentioned in the other comments likely won't work either because of USB Restricted Mode. After an hour of being locked, iOS disables data over the Lightning/USB-C port until the device is unlocked. It’s a perfect, recursive failure: you can't unlock the phone because the character is missing, and you can't plug in a hardware keyboard because the phone is locked.
Treating the passcode keyboard as a transient UI element that can be "cleaned up" rather than a hard security dependency is a massive architectural oversight. If the OS allows a character to be used in a passcode, that glyph needs to be permanently accessible in a fallback mode, no matter what the localization team decides to prune.
I agree with you and don't really get what Apple gets from removing a valid Czech character, but how would you test if all existing passcodes remain inputable without knowing the passcodes of all iPhone users?
The one way to do this that I could see is to include both the new keyboard and the old one and if someone fails to unlock with the new one auto report that to Apple (not the code, just that the unlock failed and that the keyboard might be the problem), then auto revert to the old keyboard on the next unlock attempt...
If passwords are Unicode then you need a way to input arbitrary Unicode (e.g. a Character Map dialog).
Phased roll-out. You first introduce a version that still accepts all extant inputs but will actively warn that there are characters that will be removed in a future release.
Then you wait. Then you roll out a version where the new functionality is flipped on by default, but where you still allow to explicitly toggle to the old one. Then you wait some more.
And then - only then - you roll out a release where the old functionality has been removed entirely.
It might be tricky when user upgrades while jumping the “headups” version.
There should be migration taken into consideration that is kept to any previous version allowed to be upgraded from.
For other features, yes, but not this. Of course people will work around the warnings and then suddenly they're locked out of their whole phone?
Meh, I think you keep the old keyboard and set a password expiry. New passwords use the new keyboard. Or, if you're in a rush to remove the old code, _after_ next login you require password replacement and use the new onscreen keyboard from then.
You assume the worst case: every character that could ever have been entered is in use.
> how would you test if all existing passcodes remain inputable without knowing the passcodes of all iPhone users?
You basically can't ever remove an available character.
That includes emojis if they're allowed in IOS passwords.
Probably the better solution is to include some kind of special lock-screen keyboard that provides some fallback mechanism to input any character. Presumably there are similar edge cases where someone creates a password using one keyboard, then switches keyboard layout, and now can't re-enter it using the active layout...
AI slop bot go away
> Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"?
I don't think we can assume the team is large.
Honestly of the big companies sometimes I feel like Apple is the worse offender in i18n questions
Sure they have most of their stuff translated but some rough edges make me feel they do the bare minimum:
- Their ISO keyboard sucks. Sure their overall quality makes it good but of the major brands their Enter key is the most flimsy attempt at it
- Some long standing bugs https://discussions.apple.com/thread/250299816?sortBy=rank (which I had the impressions they were made worse in localized version or at least if you used a non American date format)
- General weirdness with translation missing sometimes
> During in-house testing, which involved taking an iPhone 16 from iOS 18.5 to iOS 26.4.1, The Register found that Apple has kept the háček in the Czech keyboard, but removed the ability to use it in a custom alphanumeric passcode. The OS will not allow users to input the háček as a character. The key's animation triggers, as does the keyboard's key-tap sound, but the character is not entered into the string.
Sounds more like an actual bug than a decision to change the keyboard layout, if this happens only in the passcode screen?
> Byrne was hoping that the next update, 26.4.1, would introduce a fix for this, but its release this week has not helped.
Even if Apple restores the háček in a future update, wouldn't he still need to unlock the iPhone to install it?
afaik you can update your locked iPhone with a Mac or Windows in iTunes... but it will still require a passcode after update, so ¯\_(ツ)_/¯
Nope, the ”trust this computer” dialog needs you to enter your passcode before any other actions are possible
Probably the only hope is jailbreaking.
I think the biggest lesson here is to back up. The reason for losing access to the phone is amazingly dumb but it could have fallen down the stairs for basically the same effect.
And do your could backups cross-provider. You never know what the "big players" are going to pull, and your lifetime customer value is less than the cost of a single support call.
This is exactly the reason why I keep all my shit on an SD card despite Google deliberately making the external storage experience as painful as possible: slow access, broken writes, failed unmounts, no filesystem repair. Literally every time I restart my phone I need to put the card to my PC and repair the filesystem. Also, same card works extremely well when plugged into PC via random cheap USB card reader.
On PCs you still have Linux that resists enshittification and you can pick your own hardware, but it's a really sad state of affairs that there is literally no meaningful mobile system that isn't actively hostile to the user.
The side of my brain that manages organizational changes wonders: how does Apple, a 50 year old company of tens of thousands of engineers and over a trillion USD market cap, manage to keep feature velocity high while not making more of these types of errors?
The bug seems low likelihood but high severity for the few affected users. Other than simply never changing the login keyboard (or any of the keyboard code) or having nearly 100% test coverage, how does a company not accidentally have more of these types of issues?
They do. It’s just that the people using these devices won’t go public with it. I’ve seen so many bizarre bugs in my own experience but I’ve gotten zero articles on them by popular tech journals.
This bug got popularity that’s all.
I used to have an emoji password for my Android phone, and had the exact same issue after a reset! It's an odd but pretty terrible failure mode for locking oneself out...
You say locking oneself out, but I decline to consider any situation where a password can be set but not later entered as one where the user bears even a modicum of fault.
I lost all of my photos when I was a college student too. I was way too irresponsible to actually back anything up. Kind of a bitter lesson.
This is completely unacceptable from Apple. You CANNOT remove a key from the keyboard that's being used as a password.
Turns out they CAN and they WILL. The character has always been special on all Apple OSes.
as if they cared
As a non-English speaker I can really relate to this. I think the real mistake was Apple allowing to enter a non-ASCII password in the first place. E.g. on macOS the password fields have been locked to English character set, and I'm not sure why it changed on iOS.
Are you aware that billions of people live in countries where they could go on the whole life without seeing an ascii letter?
That's not really true in any country these days.
Regardless, why should a Vietnamese person be forced to restrict their password to ASCII? If you want to sell your devices in a country, the least you can do is to adopt to the local market. I get that Western cultural dominance makes this hard for some, but I think it should be the bare minimum.
The "real mistake" is changing things that used to work.
You can use emojis as passwords, do you think that's a good idea? They work now, there's a good chance that they won't be the same forever. See what happened to the family emojis
In my password, I have the Collectivity of Saint Martin flag emoji and United States Minor Outlying Islands flag emoji next to the French flag emoji and US flag emoji. For good measure, also the flag of Chad next to the flag of Romania. I am sure it's not going to cause any issues.
I think there's a distinction to be made between 'is it a good idea for someone informed enough to know how these things go in the real world?' i.e. the HN audience and 'should this be a real worry in a sane world?' to which I say no, it shouldn't be a worry that if I was allowed to enter a password today I may not be able to tomorrow.
That's just excuses for moronic decisions of trillion dollar companies.
Passwords are more secure if they are higher entropy, so it makes sense to support a larger variety of characters, Czech or emoji.
It seems paramount that the OS should not allow password input of any characters which it theater takes away. At the very minimum if this is absolutely necessary to make this breaking change, the user should be warned several times that a character in the password is no longer valid and maybe even prevent the OS from upgrading before the password is changed to a forward-compatible one.
Did the underlying bits (hex/oct/… or whatever representation) actually change or just the visuals?
Well, alphabets change (especially emojis), rules change, etc, so keeping a single subset of stable and known characters is unlikely to be a bad idea :)
Maybe.
But there is already a known pattern on how to handle this which I was taught (before the original iPhone even) in university CS studies:
If the manner of entering credentials has to change,
Then on first entry, offer the old method,
And, because you now (temporarily) have the plaintext credentials, you can now inspect it and test if anything need to change for the future,
And then set a flag, or require user action , or just re-encode, to use the new method as inspection determines.
But why should non-English speaking users be forced to use an ASCII password if the rest of the OS supports their language just fine?
If you remember what was the encodings situation before UTF-8 became the norm... Let's say it was really ugly. E.g. there were at least two popular encodings for Russian Cyrillic letters — CP1251 and KOI8-R, and it was _very_ common for applications getting it wrong. Restricting things like passwords (and ideally even file names) to ASCII this was a practical necessity rather than an inconvenience.
It was hard enough to spell Français correctly.
Well yes, but you can process all passwords as UTF-8, as most of strings are in mac/iOS anyways, to avoid these problems. Then just don’t break an established standard like the keyboard layout. Is that too much to ask for in 2026?
To avoid apple inevitably fucking up and breaking things like in this case. The risk to benefit ratio for allowing this is just very poor
Even if he did have a Mac with the continuity feature enabled, I suppose the lock-screen won’t accept a paste from the clipboard of a Mac. (If it did, he could enter the correct passcode in any text editor on his Mac, copy it to the clipboard on the Mac, then paste it into the lock-screen on his iPhone)
Continuity has never worked on the lock screen and certainly not in the BFU state.
This really reads like a modern Ancient-Greek story about inscrutable gods who suddenly decide to complicate your life for some unclear reason and don't respond to any prayers and rituals.
People are afraid of AI, but human organizations can be quite opaque as well.
That said, as a Czech, I wouldn't use any accentuated characters in my passwords. Anything beyond 7-bit ASCII is just asking for trouble.
Apple should get sued for this to oblivion, this is unacceptable.
there was a time when I used a simple "§" in my password. turned out, some Android keyboards don't have the "§". Since then I play it safe with my passwords, using only characters I don't need a specialized keyboard for
I assume you can use a physical keyboard on an iPhone like I can on Android via USB? Presumably you could buy a wired Czech keyboard to access the device?
Twice I have had the touchscreen fail on Android devices and been able to get what I needed off them using a USB mouse.
For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
Makes sense why he didn't do this.
You can, after you unlock it.
It’s an annoying workaround, but could he connect a USB keyboard (via a USB to lightning adapter) with the ability to enter the character? Does the passcode screen accept input from attached keyboards?
As mentioned in the article,
> For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
It's mentioned in the article. USB devices are blocked until the passcode has been entered.
Why can't people read stuff before commenting?
if you remove the hachek, there will be MANY locked out czech users. It's a symbol of national pride!
Well I only use alphanumeric US keyboard standards ever since I found out, that certain characters unique to a language different from yours causes you lock out or massive headaches on a used keyboard with almost no print ink left on the keyboard in a Internet cafe in an other country around 2002.
Be aware of characters not passwords. I feel bad for the guy but not really blame Apple here.
English is my second language and ANSI etc is following a basic character usage. Everything must boil down to 0 and 1 in the end or American English.
It is a de facto standard and maybe knowing about it is as crucial as recognizing the difference between the imperial and metric system before heading for the moon. It is a life saver.
I agree with the recommendation, but it's absurd to not blame Apple here. There is absolutely nothing acceptable about what Apple did in this case, it's a major fuck-up to break password input in this way, and for no reason whatsoever.