How many digits should a PIN actually have?

A PIN is simpler to reason about than a password: every position is one of exactly 10 digits (0–9), chosen independently, so the number of possible PINs is just 10 multiplied by itself once per digit — 10^n for an n-digit PIN. No character sets to argue about, no ambiguity about what counts as "strong." The whole calculation is one exponent.

The method

1. Count the digits in the PIN. That's the only variable — a PIN drawn from 0–9 at every position has no other source of strength.
2. Raise 10 to that power to get the number of possible PINs: 10^n.
3. Take log2(10^n) to express the same number as bits, which makes it easy to compare against passwords or keys measured in bits elsewhere. Since log2(10) ≈ 3.32193, this is just n × 3.32193.
4. Compare against the threat: a PIN typed into a door keypad or ATM that locks out after a handful of wrong tries faces a completely different attack than a PIN stored in a database an attacker can test offline, at their own pace, millions of times a second.
5. Remember leading zeros count as real digits — a PIN like 0042 is one specific value out of 10,000 four-digit PINs, not a weaker "mostly zero" one.

A worked example

This site's PIN generator makes PINs from 3 to 12 digits, defaulting to 4.

• 4 digits (the default): 10^4 = 10,000 possible PINs, or 4 × 3.32193 ≈ 13.29 bits.
• 6 digits: 10^6 = 1,000,000 possible PINs, or 6 × 3.32193 ≈ 19.93 bits.
• 8 digits: 10^8 = 100,000,000 possible PINs, or 8 × 3.32193 ≈ 26.58 bits.
• 12 digits (the maximum): 10^12 — one trillion — possible PINs, or 12 × 3.32193 ≈ 39.86 bits.

Going from 4 to 6 digits multiplies the possibilities by 100 — the same jump, in relative terms, as going from 6 to 8. Each extra digit always multiplies the space by exactly 10, which is why a "just two more digits" PIN is a hundred times harder to guess, not twice as hard.

Where this actually matters

A 4-digit PIN protecting a phone that wipes itself after 10 wrong attempts is fine — the attacker never gets anywhere near the 10,000 guesses needed, let alone enough to matter statistically. The same 4-digit PIN protecting an account with no lockout, where someone can script attempt after attempt, is a different story: 10,000 combinations is nothing to automate through in seconds. That is also why a 4-digit bank PIN has historically been paired with a hard lockout after 3 tries — the lockout is doing the real work, not the digit count. The PIN generator lets you pick any length from 3 to 12 digits and draws every digit independently from your browser's cryptographic random source.