BFU vs AFU: What Your iPhone's Lock State Actually Protects

What it is

BFU and AFU are shorthand for two states in Apple's encryption system, and they decide how much of your iPhone's data is actually readable at any given moment. BFU — Before First Unlock — is where your phone lands right after it powers on or restarts, before you've entered your passcode even once. Most of your data is locked behind the strongest encryption iOS has. AFU — After First Unlock — is every moment after that first unlock, including when the screen is locked again. The practical difference matters most in one specific situation: your phone is out of your hands. Lost, stolen, or sitting on a repair bench.

What BFU and AFU actually mean

iOS encrypts most files and keychain items using keys derived from your device passcode and the hardware UID burned into the Secure Enclave. Those keys don't just sit around waiting to be used. When they're needed, and when they get discarded, depends on which of the two states your phone is in.

In the BFU state, the decryption key for Apple's strongest protection class hasn't been reconstructed yet, because you haven't entered your passcode since the reboot. Your phone can still ring, show an alarm, or buzz for a text — but the content behind most of that stays encrypted and out of reach.

The moment you unlock the phone for the first time after a restart, it moves into the AFU state. The operating system loads the relevant encryption keys into memory so apps and background processes can keep working without re-prompting for your passcode every few minutes. Here's the part that matters: those keys stay in memory — even while the screen is locked again — until the device is powered off or restarts. That's a meaningfully different, more exposed state than BFU. The same phone can be "locked" in two very different ways depending on whether it's been unlocked since it last rebooted. If your phone is ever lost or stolen, what Stolen Device Protection does and doesn't cover is worth reading alongside this.

The Complete Protection class, in plain terms

Apple's Data Protection system sorts files and keychain items into classes, and the strongest one is Complete Protection (Class A). Shortly after your phone locks following a reboot, the decrypted key for this class is discarded entirely — not hidden, gone — until you enter your passcode again. The keychain has an equivalent setting that behaves the same way.

That's the real distinction between BFU and a phone that's simply screen-locked. A screen-locked AFU phone still has those Complete Protection keys sitting in memory, available the instant the right conditions are met. A BFU phone doesn't have them to find.

Why your iPhone restarts itself after a while

Since iOS 18.1, iPhones have carried an automatic-restart feature built for exactly this gap: a phone that's been locked and sitting idle for an extended period — roughly a few days — reboots itself, pushing it from AFU back into BFU automatically. You don't have to remember to power it off. The phone does it for you, over time. Apple's own security documentation frames this as part of a broader mechanism — Sealed Key Protection, which ties certain keys to the device's boot state. The upshot: the longer a lost or misplaced phone sits untouched, the more likely it's already reset itself back to the more protected state.

Why this matters when your phone leaves your hands

Most days, you won't think about which lock state your phone is in. It starts to matter the moment the phone isn't in your control — a borrowed phone, a stolen one, a trip to a repair counter, a family member's hands. If you still have a window to act, say through Find My before the phone goes dark, powering it off pushes it back into BFU. The same logic is worth knowing before handing your phone to a repair shop: what state the device is in when it leaves your hands affects what's realistically exposed while it's out of sight. It's also worth knowing what iCloud actually backs up versus what stays local only — BFU and AFU protection applies to the device itself, not to a copy already sitting in the cloud.

How Privara handles this

BFU and AFU describe whole-device encryption — a state you can't control minute to minute, and one that resets the moment you unlock your phone for something as ordinary as checking a text. That's exactly why it's worth keeping your most sensitive content behind a second, independent layer that doesn't depend on which lock state your phone happens to be in.

Privara hides your private photos, videos, documents, and contacts behind their own AES-256-encrypted vault — content encrypted at rest with its own key, not just hidden from view, regardless of whether your phone is in BFU or AFU at the time. From the outside, it looks and works like an ordinary calculator; the vault only opens when you enter your PIN into it, and there's no account to set up and nothing uploaded anywhere by default. It's one vault for everything — photos, videos, documents, and contacts together — so you're not relying on your phone's own unlock state to keep your most private content private. Download Privara on the App Store to set up your vault.

Frequently Asked Questions

What does BFU mean for an iPhone?

BFU stands for Before First Unlock — the state an iPhone is in right after it powers on or restarts, before the passcode has been entered even once. In this state, Apple's Complete Protection class keeps most files and keychain items encrypted with a key that only exists after you unlock the device, so almost nothing on the phone is readable.

What does AFU mean, and is it less secure than BFU?

AFU stands for After First Unlock — the state an iPhone enters the moment you enter your passcode or use Face ID/Touch ID for the first time after a reboot. The relevant encryption keys are loaded into memory at that point and stay there, even while the screen is locked again, until the phone is powered off or restarts. AFU is less restrictive than BFU, which is why it's considered a more exposed state.

Does turning off my iPhone actually make it more secure?

Yes, in a specific and useful way: powering off, or letting it auto-restart, returns the device to the BFU state, discarding the memory-resident keys that exist in AFU. If your phone is ever lost, stolen, or out of your hands, a BFU phone is far more resistant to unauthorized data access than an AFU phone is.

What is the iPhone's automatic restart feature?

Starting with iOS 18.1, iPhones automatically reboot themselves after sitting locked and idle for an extended period — roughly a few days without an unlock. This moves the device from AFU back to BFU on its own, shrinking the window during which memory-resident keys could matter if the phone ends up in someone else's hands.

Does BFU protect everything on my phone, or just some of it?

BFU protects data under Apple's strongest Data Protection class, Complete Protection, which covers most user data and many keychain items. Some data needed for background functions, like showing a text message preview or playing an alarm, uses a different class that becomes available after first unlock — part of why AFU is more permissive than BFU.