Odds of Guessing a 4-Digit PIN

Key findings

• Three guesses cover 11.7% of leaked PINs in ABC's 2025 data and 18.6% in DataGenetics' 2012 data. The equal-odds figure is 0.03%, so real choices make those guesses roughly 390 to 620 times more likely to work.
• With five guesses, ABC puts the chance at one in eight.
• 1234 alone is 9.0% of ABC's PINs and 10.7% of DataGenetics'.
• In DataGenetics' 2012 data, a third of PINs fall within the 61 most common codes, and half within 426.
• PINs people chose for unlocking a phone hold up better: in the study's no-blocklist groups, 10 guesses got into 4.6% of 4-digit and 6.5% of 6-digit PINs, and the gap between the two was not statistically significant.
• A large blocklist of 27.4% of all codes cut success after 100 guesses to 1%. Apple's own list of 274 blocked 4-digit PINs is far smaller.

Why the textbook answer is wrong

There are 10,000 possible 4-digit PINs. If people picked them at random, a thief with 3 tries at an ATM would win 0.03% of the time, about 1 in 3,333. That is a common answer, and it is also what Wikipedia's PIN article says.

The math is right. The assumption is not. People pick birthdays, repeated digits and straight lines on the keypad, so a handful of codes cover a large share of real PINs. A guesser who tries the most common ones first does far better than chance.

What leaked PIN data shows

Two large datasets rank 4-digit codes by how often people use them. Neither is made of bank card PINs. Both are four-digit passwords from leaked password lists, which researchers use as a stand-in because real bank PINs are almost never published.

1234 leads both lists by a wide margin. The rest of the order shifts between datasets: 1111 drops from 6.0% in 2012 to 1.6% in the 2025 data, and 1342, absent from the 2012 top 20, sits fourth in 2025. Different sources and collection methods explain some of this, so treat the exact ranks as approximate and the overall pattern as solid.

Odds of guessing in 3, 5, 10 and 20 tries

These figures add up the published shares of the most common PINs, which is what a guesser who tries them in order would hit.

ABC rounds each PIN's share to one decimal place, so its sums could be off by up to about half a point for 10 guesses and a full point for 20. The DataGenetics figures use its three-decimal table.

Is a 6-digit PIN safer?

On paper, yes: there are 1,000,000 possible 6-digit PINs. In practice the gain is small against someone who only gets a few tries. Markert and colleagues asked 1,220 people to choose a PIN for unlocking a phone, then attacked those PINs with guess orders built from real-world PIN datasets: PINs collected by an iPhone lock-screen app for 4 digits, and the RockYou password leak for 6 digits.

The authors found no significant difference between the two lengths at any of these levels. The authors explain that the most common 6-digit choices are more tightly bunched than the most common 4-digit ones, which offsets much of the larger keyspace when a guesser only gets a few tries. These phone PINs were also far harder to guess than the leaked-password lists above. The authors suggest that leaked website passwords are an imperfect stand-in for PINs chosen to unlock a phone, which people are primed to treat more carefully.

Do PIN blocklists help?

Only when they are big. When the study ran, Apple's iOS blocked 274 common 4-digit PINs and 2,910 6-digit ones, and the authors found those lists offered little or no benefit against a guesser with a few tries. A test list blocking 27.4% of all 4-digit codes did work: after 100 guesses, only 1% of PINs had been found.

How to pick a PIN that isn't on these lists

The simplest fix is to let chance pick it. A random PIN generator draws each digit independently, so its output is no more likely to be 1234 than any other code. Avoid anything with a pattern you would recognise: repeated digits, runs, years, and shapes on the keypad. Don't reuse the PIN from your bank card on your phone, and if a service lets you use more digits or a full passphrase, take it.

Full data table

Each row has its own link, so you can cite a single figure (for example odds-of-guessing-a-pin.html#F17).

Download this data (CSV)

Methodology and limitations

• Leaked datasets are four-digit passwords, not bank PINs. DataGenetics analysed about 3.4 million four-digit passwords from leaked lists. ABC counted 29 million four-digit entries in Have I Been Pwned's Pwned Passwords data and called it "not a perfect data set". Both are proxies.
• Computed odds assume the guesser knows the ranking. Adding up the top 3, 5, 10 or 20 shares gives the success rate for someone who tries the most common codes first, which is what published attacks do.
• ABC's shares are rounded to one decimal place, so ABC-based sums carry a medium confidence rating in the data table.
• The phone study used an online panel of 1,220 people on Amazon Mechanical Turk, primed to pick a phone unlock PIN. A later journal version of the same work reports a different participant total; this page uses the 2020 conference figure.
• DataGenetics' page shows no date. Its address points to September 2012.

Sources

1. ABC News (Australian Broadcasting Corporation). "Almost one in 10 people use the same four-digit PIN." Published January 28, 2025, updated February 14, 2025. abc.net.au
2. DataGenetics (Nick Berry). "PIN number analysis." 2012. datagenetics.com
3. Markert, Bailey, Golla, Dürmuth, Aviv (IEEE Symposium on Security and Privacy 2020). "This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs." arXiv:2003.04868

How to cite this page

Frequently asked questions

Related