How PIN codes get guessed.
Ten thousand possibilities sounds like plenty until you learn that a quarter of all PINs are one of twenty codes. What actually protects a PIN, and what a good one looks like.
The lockout does the work
A four-digit PIN has 10,000 possible values. On its own that is a small number: a computer runs through it in a fraction of a second. What makes a card or a phone safe is not the PIN but the rule around it. Three wrong attempts and the card is swallowed; ten wrong attempts and the phone wipes or waits an hour. With a hard limit on guesses, an attacker gets a handful of tries, and against a truly random PIN each try has a one in 10,000 chance.
Where there is no lockout, the arithmetic reverses. A padlock with four dials, a garage keypad that never locks out, a website with a numeric PIN and no rate limit: those are brute-forced in minutes. So the first question about any PIN is not how long it is but how many attempts the thing behind it allows.
Why three guesses are often enough
People do not pick PINs at random. Analyses of large leaked sets of four-digit codes show the same picture every time. 1234 alone is roughly one in ten of everything in use. 1111, 0000, 1212 and 7777 follow. Codes shaped like years, 19xx and 20xx, take a big share, and so do dates written as day and month. Add repeated pairs, straight runs up or down, and keypad shapes like 2580 down the middle, and around a quarter of all PINs live in a list of twenty codes.
An attacker with three attempts and that list has a far better chance than three in ten thousand. Against a PIN chosen the way people usually choose, the real odds are closer to one in four. That is the whole argument for generating a PIN instead of choosing one.
| Pattern | Examples | Why it is weak |
|---|---|---|
| Repeats | 0000, 1111, 7777 | Top of every guessing list |
| Runs | 1234, 4321, 6789 | Tried right after the repeats |
| Pairs | 1212, 6969, 1010 | Easy to type, easy to guess |
| Years | 1987, 2004 | About 100 candidates, not 10,000 |
| Dates | 0312, 2405 | Findable from a birthday |
| Keypad shapes | 2580, 1397 | Visible as a shape to anyone watching |
What a filter can remove
The PIN Code Generator draws digits from the browser's cryptographic random source and then, with the filter on, throws away anything that matches the patterns above and draws again. The cost is tiny: a few percent of the possible codes are excluded. The gain is that the result never sits in the part of the space an attacker searches first. The generator also lets you block repeated digits, which does not make a PIN stronger but does make it easier to remember for some people.
Length is a multiplier
Each extra digit multiplies the number of possibilities by ten. Six digits is a million, a hundred times more than four. Where a system offers the choice, the two extra taps are the cheapest security upgrade available, and the same lockout rules make six digits effectively unguessable. Phone makers moved their default from four to six digits for exactly this reason.
Watching beats guessing
Most PINs are not guessed at all. They are watched. A phone unlocked on a train, a card used at a till with someone standing close, a keypad in the reflection of a window. The defence is boring and effective: cover the keypad, and do not use the same code for the phone and the card that share a pocket, because whoever saw one has seen both.
Keeping a code you did not choose
Random codes feel harder to remember than they are. Say the code in chunks, 83 74 62 rather than 837462, and repeat it out loud a few times while typing it. Most people have it after a day of normal use. Never write it on the card. If you must write it down, hide it inside a longer number that means nothing to anyone else, like a made-up phone number in your contacts where only you know which digits count.
Generate a fresh one with the PIN Code Generator, four to twelve digits, with the obvious patterns already removed.