# What is a pin?

> A short numeric code, usually four to six digits, protecting a card, phone, or device behind an attempt limit.

Last reviewed: 2026-09-01

## PIN

Category: Authentication

Also called: personal identification number

Canonical page: https://moolkey.com/glossary/pin

A PIN is a short numeric code protecting a card, phone, or device. Four digits allow only 10,000 combinations, so most of a PIN's security comes from the attempt limit and from avoiding the small set of numbers that many other people choose.

### Why human PIN choice is the weak point

Analysis of 3.4 million exposed four-digit PINs found that 1234 alone accounted for over 10% of them, and the ten most common covered roughly 20%. A further large cluster follows the MMDD shape of a date or sits in the 19xx range of birth years. A thief with three attempts and a guess list does far better than 3 in 10,000.

### Six digits where you can

Moving from four digits to six multiplies the space by 100, from 10,000 to 1,000,000 combinations. Phones and banking apps generally allow it. Cards often do not, in which case randomness matters even more.

Further reading: [Generate a random PIN](https://moolkey.com/tools/pin-generator)

### Sources

- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.