4-digit PIN generator
This generator creates a random 4-digit PIN — one of 10,000 possible combinations, or 13.3 bits of entropy. It skips the patterns thieves try first: repeated digits, counting runs, mirrored pairs, birth years, and calendar dates.
- Combinations
- 10,000
- Entropy
- 13.3 bits
- One random guess
- 1 in 10,000
- Three attempts
- about 1 in 3,333
Where 4-digit PINs are used
Bank cards, ATMs, door entry keypads, voicemail, and older phone locks.
Is a 4-digit PIN secure?
The four-digit PIN survives because of the lockout, not because of the number. Ten thousand combinations would fall in under a second to anything automated; three attempts is what keeps your card safe. That protection evaporates the moment the attacker can guess intelligently — and the published data says most people make that easy.
If your card allows six digits, change it. If it does not, at minimum make sure your four digits are not a date, a year, a repeat, or a run.
The maths behind 10,000 combinations
Each of the 4 positions can hold any digit from 0 to 9, independently of the others. That gives 104 = 10,000 possible PINs, or 13.3 bits of entropy. For comparison, a single lowercase letter carries 4.7 bits, so this PIN is worth about 2.8 random letters.
Trying every combination by hand at five seconds an attempt would take 14 hours. That figure is the honest ceiling on a PIN's strength, and it is why every PIN system in the world relies on a lockout rather than on the number itself.
The four-digit PINs to avoid
Nick Berry's 2012 analysis of 3.4 million exposed PINs found that human choice is wildly non-uniform. 1234 alone accounted for over 10% of the dataset; the ten below covered roughly 20% between them.
| PIN | Share of all PINs |
|---|---|
| 1234 | 10.7% |
| 1111 | 6.0% |
| 0000 | 1.9% |
| 1212 | 1.2% |
| 7777 | 0.7% |
| 1004 | 0.6% |
| 2000 | 0.6% |
| 4444 | 0.5% |
| 2222 | 0.5% |
| 6969 | 0.5% |
Source: DataGenetics analysis of 3.4 million exposed PINs (Nick Berry, 2012).
How to remember a random 4-digit PIN
Recall practice beats repetition. Type the new PIN from memory five or six times spread across the first day, then once the next day. That spacing is what moves a number into long-term memory — reading it twenty times in a row does almost nothing.
If you would rather not depend on memory, MoolKey recreates the same PIN on demand from one private phrase, so it exists when you need it and is stored nowhere in between.
4-digit PIN questions
- How many 4-digit PIN combinations are there?
- There are exactly 10,000 possible 4-digit PINs, from 0000 to 9999. Each of the 4 positions holds one of ten digits independently, so the total is 10 to the power of 4. That works out to 13.3 bits of entropy if the PIN is chosen at random.
- What are the odds of guessing a 4-digit PIN?
- A single random guess has a 1 in 10,000 chance of being right. With the usual three-attempt lockout, an attacker guessing at random has about 1 in 3,333. Those odds only hold if your PIN was chosen randomly — a date or a repeated digit puts you in a set of a few hundred candidates, not 10,000.
- Is a 4-digit PIN secure enough?
- Four digits is weak in theory and much weaker in practice, because human choice collapses into a handful of patterns. If your card allows six digits, change it. If it does not, at minimum make sure your four digits are not a date, a year, a repeat, or a run.
- Where are 4-digit PINs used?
- Bank cards, ATMs, door entry keypads, voicemail, and older phone locks. The four-digit PIN survives because of the lockout, not because of the number.
More free tools
Every tool runs in your browser without an account. The generators, strength checker, and entropy calculator keep inputs local. The breach checker sends only a five-character hash prefix to Have I Been Pwned.
Password generator
A password generator creates a random string that no person would think of and no wordlist contains.
Passphrase generator
A passphrase is several random words joined together, such as "trout-canyon-mellow-drift".
Strength checker
A password strength checker estimates how many guesses an attacker needs before reaching your password.
Breach check
A breach check tells you whether a password already appears in leaked data.
Entropy calculator
Password entropy measures how many guesses an attacker needs, expressed in bits.
Make one account easier today.
Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.