Why a PIN you choose is weaker than it looks
A PIN has few combinations, and what protects it is that the device locks after a few failures: the ATM keeps the card, the SIM asks for the PUK and the phone makes you wait longer each time. That defense only works if the PIN is unpredictable.
It usually is not. In 2012 Nick Berry of DataGenetics analyzed 3.4 million leaked 4-digit PINs and found this:
| PIN | Frequency | Why people pick it |
|---|---|---|
| 1234 | 10.7% | A run |
| 1111 | 6.0% | Repeated digit |
| 0000 | 1.9% | Factory default |
| 1212 | 1.2% | Repeated block |
| 7777 | 0.7% | Repeated digit |
The 20 most common PINs added up to more than a quarter of the total. Birth years (19xx) and dates are the next group tried, especially if the thief has your ID card in the same wallet.
How many digits to use
| Digits | Combinations | With 3 tries, 1 success every | Where it is used |
|---|---|---|---|
| 4 | 10,000 | 3,333 times | Bank cards, SIM cards |
| 6 | 1,000,000 | 333,333 times | Phones, banking apps |
| 8 | 100,000,000 | 33,333,333 times | Alarms, safes, PUK codes |
The table counts every combination. Skipping the easy PINs leaves slightly fewer, and the generator tells you exactly how many above the scale.
A PIN cannot survive an attack without an attempt limit
If someone can keep guessing without a lockout, a 6-digit PIN falls in under a second. That is why the meter shows so few bits: a PIN is only safe inside a device that counts failures. To encrypt a file, a backup or a password manager, use a passphrase, never a PIN.
Frequently asked questions
Is a 4-digit PIN secure?
Only because the device limits the attempts. There are 10,000 combinations, and with 3 tries before lockout someone guessing blindly gets it right 1 time in 3,333. The trouble is that people do not choose at random: in DataGenetics’ analysis of 3.4 million PINs, 1234 accounted for 10.7% of them. With 3 well-chosen guesses, a thief would get in nearly 1 time in 5.
Which PINs does the generator skip?
With the option ticked, it skips the ones that get tried first: all the same digit (0000), runs (1234, 9876), repeated blocks (1212, 123123), mirror patterns (1221), years from 1900 to 2099, day-month and month-day dates, and a list of the most used ones, including keypad columns like 2580.
Does skipping PINs make it weaker?
Slightly, and we count it: with 4 digits fewer than 10,000 combinations remain, and the meter shows the exact number. In exchange you remove exactly the ones an attacker would try first, so in practice you come out ahead.
Is 6 digits better than 4?
Yes, if the device allows it. You go from 10,000 to a million combinations. Modern phones ask for 6 by default. If your phone accepts an alphanumeric password, even better: a short passphrase does not take much longer to type.
Can I use the same PIN for my card and my phone?
Better not. If someone watches you type one (at an ATM or on the bus) and then steals your wallet with your phone in it, they have both. A different PIN for each use costs very little.