How Many Combinations Does a PIN Have?
A PIN's strength comes almost entirely from its length, since it only ever uses 10 possible digits. If digits can repeat, the count is simply 10 raised to the power of the length. If you require every digit to be different, the count shrinks to a permutation of the available digits instead.
| Length | Digits may repeat | All digits unique |
|---|---|---|
| 4 digits | 10,000 | 5,040 |
| 5 digits | 100,000 | 30,240 |
| 6 digits | 1,000,000 | 151,200 |
| 7 digits | 10,000,000 | 604,800 |
| 8 digits | 100,000,000 | 1,814,400 |
A 4-digit PIN sounds like ten thousand options, but real-world PINs are far from evenly distributed — a small handful of combinations (birthdays, repeated digits, simple sequences) account for a disproportionate share of PINs people actually choose, which is exactly what makes those combinations the first ones an attacker tries.
Why Some PINs Are Weaker Than They Look
A PIN doesn't need to be "cracked" mathematically to be guessed — it just needs to match a pattern someone predicts. That's why these are worth avoiding even though they're technically valid 4 to 8 digit numbers:
- Birthdays and years — anything that looks like a date (0304, 1998) is one of the first things tried.
- Phone numbers — especially the last four digits, which are often visible or guessable.
- Repeated digits — codes like 1111 or 000000 are among the most commonly used PINs on record.
- Sequential runs — 1234, 4321, and similar patterns are tried early by anyone guessing manually.
Choosing a PIN Length
Many devices and cards still default to a 4-digit PIN, but a 6-digit PIN is now common and meaningfully harder to guess with no real cost to convenience — most people can still recall six digits reliably. For anything where longer PINs are supported, such as a phone lock screen, 6 to 8 digits is a reasonable target. Where a system restricts you to exactly 4 digits, generating one randomly still removes the human bias toward dates and patterns.