When PINs Are Appropriate
PINs provide a limited level of security that relies on rate-limiting — the device locks after a few failed attempts. A 4-digit PIN has only 10,000 possible combinations, which a computer could try exhaustively in under a second. But when a phone locks after 10 wrong guesses, an attacker gets 10 chances out of 10,000 — a 0.1% success rate.
This makes PINs appropriate for physical devices (phones, ATMs, safes) where rate-limiting is enforced by hardware. They should never be used as passwords for online accounts, where an attacker may obtain the hashed PIN and crack it offline.
Common PIN Mistakes
✕Birth years (1990, 1985) — among the first guesses attackers try
✕Sequential digits (1234, 4321, 0123) — the most common PINs worldwide
✕Repeated digits (1111, 0000, 7777) — trivial to guess
✕Phone keypad patterns (2580, 0852) — visible as swipe patterns
✕Addresses or zip codes — easily found via social engineering
A truly random PIN avoids all of these patterns. Every digit is independently selected with equal probability.