Why a random PIN matters
People choose PINs in very predictable ways. Analyses of leaked PIN datasets consistently show that a small set of codes — 1234, 1111, 0000, 1212, 7777 and years like 1990–2010 — account for a large share of all four-digit PINs. A thief who tries the most common handful of codes has a far better chance than 1 in 10,000. A random PIN gives every code an equal chance, which is exactly what limited attempts are designed to protect.
What “avoid weak PINs” filters out
- All-same digits:
0000,999999 - Ascending and descending runs:
1234,456789,9876,8901 - Repeating pairs:
1212,696969 - Four-digit years from 1900 to 2099:
1987,2024
Filtering removes only a tiny fraction of possible codes, so the PIN stays almost as random while avoiding the guesses attackers try first.
Which PIN length should you use?
| Length | Combinations | Typical use |
|---|---|---|
| 4 digits | 10,000 | Bank cards, SIM cards, padlocks, garage keypads |
| 6 digits | 1,000,000 | Smartphones, Windows Hello, voicemail, many banking apps |
| 8 digits | 100,000,000 | Safes, alarm systems, router WPS, business phones |
| 10+ digits | 10 billion+ | Encryption PINs, recovery codes, numeric-only passwords |
A PIN is safe at short lengths only because the device locks after a few wrong attempts. Anything that might be attacked offline needs a real password instead.
Tips for using PINs safely
- Use a different PIN for your phone, your bank card and your SIM card.
- Never write the PIN on the card or keep it in your wallet.
- Shield the keypad when typing — shoulder-surfing and cameras are the most common way PINs are stolen.
- Change a PIN immediately if you suspect someone saw it.
Last updated: · Reviewed by the Password Generator team