PIN Strength Calculator
PIN digits and rate to combos and crack time.
What it does
PINs hide behind tiny math with huge consequences: four digits means ten thousand combos, and guess rate decides whether that falls in minutes or years. Combinations over rate sets the clock.
The tool above raises ten to the digits, halves for the average guess, divides by rate, and prints combos, human time, and entropy bits. Throttled keypads, fast software, and offline hashes sit worlds apart.
NIST authenticator guidance with cybersecurity agency password advice frames PIN strength this way: length and rate dominate, lockouts reshape reality. Entropy at 3.32 bits per digit lets PINs compare with passwords fairly.
Lengthen what matters, throttle the rest. Random digits beat birthdays at any length, managers beat memory for accounts, and second factors cover what math cannot.
How to use
- Enter PIN digit count.
- Enter guess rate per second.
- Read total combinations.
- Read average crack time.
- Read entropy bits.
- Lengthen or throttle from the answer.
Formula
- digits
- PIN length, whole digits 1 to 20.
- rate
- Guesses attempted per second.
Average-case guessing at a steady rate with no lockouts. Entropy uses log2(10) at 3.321928 bits per digit. Human time units scale from seconds to years for readability.
Worked example
Example: 4 digits at 10/s
4-digit PIN against 10 guesses per second.
- Four-digit PIN at 10 guesses per second.
- Combos: 10^4 = 10,000.
- Average guesses: 10000 / 2 = 5000.
- Time: 5000 / 10 = 500 s = 8.3 min.
- Entropy: 4 x 3.32 = 13.3 bits.
Reference table
| Digits | Combos | Average time |
|---|---|---|
| 4 | 10,000 | 5 s |
| 6 | 1,000,000 | 8.3 min |
| 8 | 100,000,000 | 13.9 hr |
| 10 | 10 billion | 57.9 days |
| 12 | 1 trillion | 15.9 yrs |
Limits
- Steady guessing assumed. Lockouts change reality.
- Average case; luck halves or doubles it.
- Rate guesses dominate; verify context.
- Patterns fall faster than math says.
Common mistakes
- Using birthdays and 1234.
- Ignoring lockout protection.
- Confusing max with average guesses.
- Trusting short PINs for valuables.
- Skipping 2FA where offered.
Try it yourself
Quick checks. Answers sit tucked under each question.
6 digits at 1000 guesses per second?
Combos are 10^6 = 1,000,000. Average 500,000 tries at 1000/s = 500 s = 8.3 min. Entropy is 19.9 bits.
8 digits at 1000 guesses per second?
Combos are 10^8 = 100,000,000. Average 50,000,000 at 1000/s = 50,000 s = 13.9 hr. Entropy is 26.6 bits.
Questions
How is PIN strength figured?
Ten to the digits, halved for the average guess: 10,000 combos means 5,000 average tries. Time divides by guess rate; entropy runs 3.32 bits per digit.
What guess rate applies?
Throttled keypads near 10 per second, fast software near 1000, offline hashes near billions. Rate decides everything: same PIN dies in minutes or millennia.
Is 6 digits much better than 4?
Six digits at 1000 per second: 1,000,000 combos, 8.3 min average, 19.9 bits. Length helps linearly in digits, exponentially in combos.
Does randomness matter?
No. Smudge patterns, birthdays, and 1234 fall first regardless of math. Randomize digits and shield entry.
Do lockouts change the math?
Yes, plus lockouts and delays after failures. Rate limiting beats length past a point; this page assumes steady guessing.
What should I actually use?
Longer random secrets with a manager for accounts, plus 2FA where offered. PINs suit device unlock with wipe-after-fails behind them.