About PINs
PINs (Personal Identification Numbers) are numeric codes commonly used for authentication, especially for banking, device access, and other scenarios where numeric-only input is required.
Common uses for PINs
- Bank card PINs (typically 4 digits)
- Device unlock codes (phones, tablets)
- Office door access codes
- ATM transactions
- Two-factor authentication backup codes
How guessable is a PIN, really?
A random 4-digit PIN is one of 10,000 possibilities. Human-chosen PINs are not random. In a widely cited 2012 analysis of about 3.4 million four-digit codes from leaked datasets, DataGenetics found that 1234 alone accounted for roughly 11% of all PINs, 1111 for about 6%, and 0000 for nearly 2%. The 20 most popular codes covered more than a quarter of the whole set, and dates in the 19xx range were heavily overrepresented.
That changes the risk of a lost card or phone dramatically. Most systems allow only a few attempts before locking:
| Scenario | Chance an attacker guesses it |
|---|---|
| Random 4-digit PIN, 3 attempts (typical bank card) | 0.03% (3 in 10,000) |
| Human-chosen 4-digit PIN, 3 attempts (1234, 1111, 0000) | ~19% based on the data above |
| Random 4-digit PIN, 10 attempts (phone with wipe-after-10 enabled) | 0.1% |
| Random 6-digit PIN, 10 attempts | 0.001% (10 in 1,000,000) |
In other words, a predictable PIN is several hundred times easier to guess than a random one under the same lockout rules. That is why the generator skips predictable patterns by default. Excluding them removes 318 of the 10,000 four-digit options (about 3%), which lowers the entropy only from 13.29 to 13.24 bits — a negligible cost for removing the codes an attacker would try first.
One limit to keep in mind: PINs are only safe because of those lockouts. If a PIN protects something that can be attacked offline — an encrypted file, or a PIN hashed in a stolen database — every 4- to 8-digit PIN is found in well under a second. Use a passphrase or a long random password there instead. Our guide on how password cracking works explains the difference.
Security considerations
- PINs are less secure than passwords due to limited character set
- Use longer PINs (6-8 digits) when possible for better security
- Avoid predictable patterns like 1234, 0000, or repeated digits
- Don't use personal information like birth dates
- Change a PIN if someone may have seen you enter it, rather than on a fixed schedule
Frequently Asked Questions
What's a good PIN length?
4 digits is the minimum for most systems, but 6-8 digits is more secure. Use the maximum length allowed by the system.
Are PINs secure?
PINs are less secure than passwords but acceptable for applications with rate limiting and lockout mechanisms (like bank cards with limited attempts).
Should I use the same PIN for multiple devices?
No. Use unique PINs for each device or account to limit the impact if one is compromised.
Can I include letters in a PIN?
Most systems only accept numeric digits. If the system supports alphanumeric codes, consider using a passcode or password instead.