Notes app Password Recovery

[MaxS22]

Hi all,

I'm very sorry for my utter lack of knowledge of all things coding, but I need some help. I recently made a password for my Notes app on my iPhone and have since forgotten the password. There is no way for me to change or recover it per Apple, I can only change the password for future locked Notes. My current locked Notes have a lot of important information in them that I need to get access to, so I have been looking into how I can brute force my way into getting access.

The things I know about the password I set:

It is only numbers
I strongly believe it is 6 numbers long (could be 4 or 5, but this is much less likely)
It does not start with a 00, 1, 4, or 7
It likely starts with 3, 6, or 9 (but I am less sure about this)
I believe that if there are any repeated numbers, then there should only be at most 2 numbers that were repeated. 

I hope this is somewhat helpful. I would love to get any help for how to go about recovering this passcode so I don't have to try like 100,000 different codes. I unfortunately don't know a lick about coding or the terms used in coding, so hopefully someone can explain a solution in the most layman's terms possible. Hopefully this post is allowed here. Happy to provide any other information if needed (this is in fact my iPhone, this advice will no be used for any nefarious/illegal activity).

Thank you very much in advance.

[Banaanhangwagen]

you need to look for the file NoteStore.sqlite on your phone and extract it (done with iTunes-backup for example)
next, with this tool you can extract the hashes from the sqlite-db: https://github.com/openwall/john/blob/bl...es2john.py

once you have the hashes, you can use hashcat with a custom mask since you know it's only 4,5 or 6 digits

[MaxS22]

you need to look for the file NoteStore.sqlite on your phone and extract it (done with iTunes-backup for example)
next, with this tool you can extract the hashes from the sqlite-db: https://github.com/openwall/john/blob/bl...es2john.py

once you have the hashes, you can use hashcat with a custom mask since you know it's only 4,5 or 6 digits

Thank you for this!! I should be able to find that NoteStore.sqlite file and extract it, but I am a little unsure about extracting hashes and using a custom mask. If there another resource you could point me to that would explain that for me please?

Thank you again for your help!

[Xyrics21]

I actually found two tricks to access locked notes without password. But I don't know if I can share the link with detailed steps here. Here are the detailed operation. If you need photo guide, you can check it on magfone.
Case 1. On iPhone 6 with iOS 12
Step 1. Go to iPhone Settings and find Notes.
Step 2. Tap Passwords > Reset Password.
Step 3. Enter the required Apple ID password, then tap Reset Password to reset it.
Step 4. Create a new password for Notes and enable Use Touch ID or Use Face ID.
Step 5. Open Notes and access the locked note, tap View Note, and use your Touch ID or Face ID to unlock it.

Case 2. On iPhone 11 with iOS 26
Step 1. Go to iPhone Settings > Apps > Notes.
Step 2. Tap Password and choose the Notes account that includes the locked note.
Step 3. Choose Use Device Passcode and tap Enter Password.
Step 4. Enter a wrong password, then tap Forgot Password.
Step 5. Choose Switch Anyway and enter your iPhone passcode for Notes. Then tap OK.
Step 6. Now you can open the Notes app and access your locked notes with the iPhone passcode.