id,claim,value,unit,scope,data_period,source_publisher,source_url,accessed
F1,Chance of guessing a 4-digit PIN in 3 tries if every PIN were equally likely,0.03,%,"Theoretical uniform choice over 10,000 PINs",n/a,Computed (arithmetic),,2026-09-25
F2,Same baseline for 5 tries,0.05,%,Theoretical,n/a,Computed (arithmetic),,2026-09-25
F3,Same baseline for 10 tries,0.1,%,Theoretical,n/a,Computed (arithmetic),,2026-09-25
F4,Four-digit passwords analysed by DataGenetics,3.4,million passwords,"Leaked password lists; all 10,000 combinations present","Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F5,Share of DataGenetics dataset that was 1234,10.713,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F6,Share that was 1111,6.016,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F7,Share that was 0000,1.881,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F8,Share covered by the 20 most common PINs,26.83,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F9,Distinct guesses needed to cover one third of all codes,61,guesses,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F10,Distinct guesses needed to pass 50% cumulative,426,guesses,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F11,"Least used PIN in the DataGenetics dataset: 8068, with 25 occurrences",0.000744,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F12,PINs analysed by ABC from Have I Been Pwned,29,million,Pwned Passwords API values that are four digits,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F13,Share of ABC dataset that was 1234,9.0,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F14,Share that was 1111,1.6,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F15,Share that was 0000,1.1,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F16,ABC's stated chance of guessing correctly with five guesses: one in eight,one in eight,ratio,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F17,Chance the top 3 PINs cover a random PIN (ABC data),11.7,%,"ABC dataset, ranks 1-3","Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F18,Chance with the top 5 (ABC data),12.7,%,"ABC dataset, ranks 1-5","Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F19,Chance with the top 10 (ABC data),14.2,%,"ABC dataset, ranks 1-10","Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F20,Chance with the top 20 (ABC data),16.5,%,"ABC dataset, ranks 1-20","Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F21,Chance with the top 3 (DataGenetics data),18.61,%,"DataGenetics dataset, ranks 1-3","Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F22,Chance with the top 5 (DataGenetics data),20.552,%,"DataGenetics dataset, ranks 1-5","Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F23,Chance with the top 10 (DataGenetics data),23.335,%,"DataGenetics dataset, ranks 1-10","Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F24,How many times more likely 3 tries succeed vs the uniform assumption (ABC data),390,x,ABC vs uniform,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F25,Same comparison using DataGenetics data,620,x,DataGenetics vs uniform,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F26,Participants in the Markert et al. smartphone PIN study,1220,people,"Amazon Mechanical Turk, primed for phone unlock",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F27,4-digit phone PINs guessed within 10 tries (the iOS maximum),4.6,%,"Study's no-blocklist groups; throttled attacker using real-world PIN guess orders (Amitay iOS lock-screen data for 4 digits, RockYou for 6 digits)",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F28,6-digit phone PINs guessed within 10 tries,6.5,%,"Study's no-blocklist groups; throttled attacker using real-world PIN guess orders (Amitay iOS lock-screen data for 4 digits, RockYou for 6 digits)",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F29,4-digit PINs guessed within 30 tries,7.6,%,"Study's no-blocklist groups; throttled attacker using real-world PIN guess orders (Amitay iOS lock-screen data for 4 digits, RockYou for 6 digits)",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F30,6-digit PINs guessed within 30 tries,8.9,%,"Study's no-blocklist groups; throttled attacker using real-world PIN guess orders (Amitay iOS lock-screen data for 4 digits, RockYou for 6 digits)",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F31,4-digit PINs guessed within 100 tries,16.2,%,"Study's no-blocklist groups; throttled attacker using real-world PIN guess orders (Amitay iOS lock-screen data for 4 digits, RockYou for 6 digits)",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F32,6-digit PINs guessed within 100 tries,13.3,%,"Study's no-blocklist groups; throttled attacker using real-world PIN guess orders (Amitay iOS lock-screen data for 4 digits, RockYou for 6 digits)",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F33,PINs on Apple's iOS 4-digit blocklist,274,PINs,iOS as extracted by the authors,User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F34,PINs on Apple's iOS 6-digit blocklist,2910,PINs,iOS as extracted by the authors,User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F35,"4-digit PINs guessed within 100 tries when a 2,740-PIN blocklist was enforced",1,%,DD-4-digit-2740 treatment (blocks 27.4% of the keyspace),User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F36,Possible 4-digit PINs (0000 to 9999),10000,PINs,All 4-digit codes,n/a,Computed (arithmetic),,2026-09-25
F37,Possible 6-digit PINs,1000000,PINs,All 6-digit codes,n/a,Computed (arithmetic),,2026-09-25
F38,"Uniform-choice odds of 3 guesses, expressed as 1 in N",3333,1 in N,Theoretical,n/a,Computed (arithmetic),,2026-09-25
F39,Uniform-choice odds of 20 guesses,0.2,%,Theoretical,n/a,Computed (arithmetic),,2026-09-25
F40,"Top-3 odds in ABC data, expressed as 1 in N",8.5,1 in N,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F41,"Top-3 odds in DataGenetics data, expressed as 1 in N",5.4,1 in N,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F42,Share of the 4-digit keyspace blocked by the large test blocklist,27.4,%,DD-4-digit-2740 treatment,User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25
F43,"Occurrences of 8068, the least used PIN, in the DataGenetics dataset",25,occurrences,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F44,DataGenetics rank 4: 1212,1.197,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F45,DataGenetics rank 5: 7777,0.745,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F46,DataGenetics rank 6: 1004,0.616,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F47,DataGenetics rank 7: 2000,0.613,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F48,DataGenetics rank 8: 4444,0.526,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F49,DataGenetics rank 9: 2222,0.516,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F50,DataGenetics rank 10: 6969,0.512,%,DataGenetics dataset,"Four-digit passwords from leaked password lists, collected before Sept 2012",DataGenetics (Nick Berry),http://www.datagenetics.com/blog/september32012/,2026-09-25
F51,ABC rank 4: 1342,0.6,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F52,ABC rank 5: 1212,0.4,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F53,ABC rank 6: 2222,0.3,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F54,ABC rank 7: 4444,0.3,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F55,ABC rank 8: 1122,0.3,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F56,ABC rank 9: 1986,0.3,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F57,ABC rank 10: 2020,0.3,%,ABC dataset,"Have I Been Pwned Pwned Passwords data as queried by ABC, Jan 2025",ABC News (Australian Broadcasting Corporation),https://www.abc.net.au/news/2025-01-28/almost-one-in-ten-people-use-the-same-four-digit-pin/103946842,2026-09-25
F58,PINs in the large test blocklist (DD-4-digit-2740),2740,PINs,"Study treatment, not a deployed blocklist",User study on Amazon Mechanical Turk over three weeks,"Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020)",https://arxiv.org/abs/2003.04868,2026-09-25