How PINs are protected
A 4-digit PIN has only 10,000 possible combinations, a number any computer can run through in a fraction of a second. PINs stay safe for a different reason: the device limits how many times you can try. A bank card is blocked after three wrong attempts, a SIM card after three, and phones add longer and longer delays or wipe themselves after around ten.
That means a thief gets a handful of guesses. Your PIN is safe as long as it isn't among the codes they'll try first.
The PINs everyone guesses first
Studies of millions of real PINs show the same picture every time: a small group of codes covers a large share of all PINs.
- Simple sequences:
1234,4321,123456,0123 - Repeats:
0000,1111,2222,1212 - Keypad patterns:
2580(straight down the middle),1470,1397 - Years: anything from
1950to2025, especially birth years - Dates: birthdays and anniversaries as DDMM or MMDD, like
0512or2412
A thief who finds your wallet also finds your ID, so your birthday is the very first thing they'll try.
How long should a PIN be?
- 4 digits is fine for a bank card or SIM, which block quickly, but only if it's random.
- 6 digits is the sensible minimum for your phone. It's 100 times more combinations than 4 digits and barely harder to type.
- 8 digits or more for anything that protects a lot of data, or use a full passcode or passphrase instead.
Why random beats memorable
Every trick for making a PIN memorable (a date, a pattern on the keypad, a meaningful number) makes it more predictable. A random PIN avoids all of them at once. It sounds hard to remember, but most people learn a new PIN within a few days of typing it. If you're worried you'll forget, keep it in your password manager.
Our PIN generator picks every digit with your browser's secure random generator, so every code is equally likely and none is "special".
Don't reuse your PIN
Use different PINs for your phone, SIM card and bank cards. If someone watches you unlock your phone on the train, they shouldn't also have the code to your debit card. Change the default PIN on your SIM card, often 0000 or 1234, so a stolen phone can't be used to take over your number.
When a PIN isn't enough
PINs rely on that attempt limit. Anything that can be attacked without one, such as an encrypted file, a backup or a password manager, needs a real password or a long passphrase. If you're unsure, use the password strength checker to see the difference.