PIN vs password: Why can six digits unlock your phone?

A website asks you for a long password. Your phone, which contains your email, photos, messages and possibly access to your bank account, lets you use six digits. Your computer might even suggest a PIN after you've already given it a perfectly good password.

This seems backwards. If short passwords are weak, why do we trust short PINs with devices that contain so much of our life?

The answer is that a secret's strength depends on both how hard it is to guess and what the system allows an attacker to do. Six digits aren't suddenly difficult to guess because we call them a PIN. But guessing six digits on a protected device can be a very different task from guessing a password stolen from a website.

What is the difference between a PIN and a password?

A PIN, short for personal identification number, is usually a sequence of digits. A password can contain letters, numbers, spaces and symbols. A passcode is a broader term often used for the secret that unlocks a device; it may be numeric or alphanumeric.

These names tell you something about what you type, but surprisingly little about how it's protected. A banking app's PIN, a phone's screen lock and a code entered on a website might look identical while doing very different jobs.

Similar-looking secrets can protect very different things

Secret	Typical purpose	What matters beyond its length?
Phone PIN or passcode	Unlock a particular device and help protect its data	Device security, limits on guesses, and whether someone sees you enter it
Windows Hello PIN	Unlock a credential associated with that device	Protection of the device and its cryptographic keys
Website password	Sign in to an account, often from many devices	Uniqueness, length, server storage and login protections
One-time verification code	Approve a particular login or action	Expiry, limits on attempts, delivery method and phishing

That last distinction is easy to miss. A six-digit code sent to your phone is not the same thing as your six-digit screen lock. One is supposed to expire; the other keeps working until you change it. Neither should be shared just because someone calls it a “verification” step.

Is a six-digit PIN actually hard to guess?

By itself, no. If every digit can be anything from 0 to 9, there are ten choices for each position. A four-digit PIN has 10,000 possible combinations, while a six-digit PIN has 1,000,000. That includes codes starting with zero, where the system permits them.

Numeric PIN combinations, assuming every combination is allowed

PIN length	Possible combinations	Compared with four digits
4 digits	10,000	Starting point
6 digits	1,000,000	100 times as many
8 digits	100,000,000	10,000 times as many
10 digits	10,000,000,000	1,000,000 times as many

Each extra random digit multiplies the search space by ten. That's useful, but it doesn't give us a universal cracking time. We still need to know how quickly guesses can be checked, whether attempts are limited, and whether the PIN was chosen randomly in the first place.

For example, suppose a system allowed exactly ten distinct guesses before permanently stopping further attempts. Against a uniformly random four-digit PIN, those guesses would have a 0.1% chance of success. Against a uniformly random six-digit PIN, they would have a 0.001% chance. This is a simplified example, not a description of any particular phone's lockout policy.

Now remove the limit and let a program check guesses quickly. The same million combinations become a much smaller obstacle. A short PIN needs the system around it to make repeated guessing difficult.

The important distinction: online and offline guessing

When an attacker tries passwords through a website's login form, they're making an online attack. The website gets to decide whether to accept another attempt. It can slow down guesses, block suspicious activity or require another authentication step.

An offline attack is different. If attackers steal a database containing password hashes, they may be able to test guesses on their own computers. They don't need to ask the website for permission each time. The site's login limits no longer control those checks.

A hash is a value derived from a password that a service can use to check a login. Secure storage makes testing guesses more expensive, but it doesn't make a predictable password unguessable. We explain the storage side in more detail in how your passwords are stored.

This is why “it locks me out after a few attempts” isn't a complete defence of a short website password. That protection helps at the login form. It doesn't give the password more possibilities if the stored verification data is stolen.

What makes a phone PIN different?

A well-protected phone doesn't simply hand over a file that lets anyone check PIN guesses at unlimited speed. Its security design can connect the passcode to hardware-backed protection and enforce delays between failed attempts.

For example, Apple's platform security documentation describes how passcodes contribute to data protection and how invalid attempts trigger increasing delays. Exact protections depend on the device and its state, so a generic “seconds to crack a PIN” calculator can't fully describe the situation.

There is a similar distinction on a computer using Windows Hello. Microsoft explains that a Hello PIN is tied to the particular device. It unlocks a device-associated credential; it isn't simply a shorter replacement password sent to every service you use.

This doesn't make short PINs invincible. Device vulnerabilities, weak implementations and someone learning the code can change the situation. It does explain why comparing a local PIN with an online password by counting characters alone misses much of the picture.

Why a longer PIN can still be predictable

People rarely choose numbers as randomly as they think. We like dates, repetitions and shapes our fingers can trace on a keypad. Moving from four digits to six doesn't help nearly as much if the extra digits just extend an obvious sequence.

Consider these examples. They're illustrations of weak choices, not suggestions to use.

Longer codes don't necessarily mean better choices

Example	Why it feels convenient	Why it's predictable
123456	Easy to type and remember	It's an obvious ascending sequence
777777	Only one digit to remember	Repeating a digit adds length without much surprise
121212	A simple rhythm	It repeats a short, familiar pattern
150698	Could represent 15 June 1998	A known birthday gives someone a reason to try it
2580	A straight line on many keypads	The keypad layout supplies the pattern

Attackers don't have to start at 000000 and work upwards. They can try likely choices first. If your PIN is your birthday, the relevant question isn't just “how many six-digit numbers exist?” It's also “how many guesses would someone who knows my birthday need?”

The same problem appears in passwords. A name followed by a year and an exclamation mark looks more complicated than a name alone, but it still follows a familiar recipe. Our articles on personal information in passwords and letter substitutions like p4ssw0rd cover those habits.

Should you use the same PIN everywhere?

It's tempting. You already remember one code, so why invent another for your phone, tablet, banking app and anything else that asks?

The problem is that learning one secret now helps someone in several places. A person who sees you enter an app PIN may try it on your phone. A code you shared for a household device may also unlock something much more personal.

Device binding still matters here. Knowing a Windows Hello PIN doesn't, by itself, let someone sign in to your Microsoft account from an unrelated computer. But if you reuse those same digits as a website password, you've separately created an online secret they can try. The protection of one system doesn't follow the digits into another.

Also avoid putting your actual PIN inside a password. If a password such as River482951! is exposed and those six digits are your phone PIN, you've given away a useful clue. Adding words around a reused secret doesn't keep the reused part private.

A strong PIN doesn't help if someone watches you enter it

So far, we've talked about guessing. In everyday life, someone might simply see the answer.

This is often called shoulder surfing. It could happen in a queue, on public transport or while you're unlocking a device for someone nearby. A random eight-digit PIN is much harder to guess than a birthday, but observing all eight digits removes that advantage.

Cover the keypad when practical, and pay attention to who's watching when you enter a device passcode. Fingerprint or face unlock can reduce how often you type the code in public, although the passcode still matters when the device asks for it as a fallback.

If someone has seen your PIN, change it. Making it longer next month won't undo the fact that someone knows the code that works today.

How do you choose a strong PIN or password?

Start with what you're protecting and what the system supports.

• For a phone: choose a randomly generated PIN of at least six digits when available. A longer random PIN, or a strong alphanumeric passcode, gives more resistance to guessing if you're comfortable entering it reliably.
• For a system limited to four digits: avoid dates, repetitions and keypad patterns. Keep the code separate from other important secrets. The system's limits on attempts remain essential.
• For a website: use a unique password generated and saved by a password manager. Aim for at least 16 random characters where supported, rather than trying to make a short numeric code do the job.
• For a password you must remember: consider a long passphrase made from several independently random words. A favourite quote or a sentence about your life isn't equivalent to randomly selecting words.

Random generation matters because it avoids the patterns we naturally invent. Generate your own secret; don't copy one from an article, including this one. A published example is no longer secret, however complicated it looks.

For account passwords, this emphasis on length and uniqueness is consistent with NIST's digital identity guidelines. They require services following the standard to set a minimum of 15 characters for passwords used as a single authentication factor, while permitting a lower minimum when the password is part of multi-factor authentication. A minimum length is a baseline, not proof that any password meeting it is good.

You can use our password generator to create a fresh password and our PIN checker to explore predictable PIN patterns. Use made-up examples when experimenting with checkers; there's no need to enter an existing banking PIN or device passcode to understand what makes one weak. A checker also can't verify the security of the device or service behind your code.

So is a PIN safer than a password?

There isn't a useful answer without knowing where it's used. A device-bound PIN protected by hardware and limits on attempts can be a sensible way to unlock a device. The same digits used as an ordinary account password are a weak choice.

The practical approach is straightforward: use a random, separate PIN for your device, use long and unique passwords for accounts, and enable multi-factor authentication where available. Keep your devices updated, and treat anyone seeing your code as a reason to change it.

Six digits don't become strong because they're called a PIN. They become useful when the system makes those digits difficult to test, and you keep them difficult to learn.