# Is there Algorithm determining weakness of PIN-code?

There are several algorithms that can tell us if our password is strong enough analyzing its length, considering if it uses upper and lowercases, special symbols and digits, considering if it is not a dictionary word.

My question is: is any algorithm exist that can tell me at least two levels of weakness (weak and strong) for 4-digits pin-code? (For example: all digits are different, digits are not increasing or decreasing order (1234, 4321), PIN is not representing year (1986), etc.) Thank you.

• password strength meters are about the available symbol-space [a-z, A-Z, 0-9, special chars] - pins have only one set of digits: [0-9] Jan 3, 2017 at 11:53
• what you appear to be asking for is an analysis of the patterns of the digits - which comes down to a measure entropy (years, keypad patterns, repeating chars, random selection, etc.) Jan 3, 2017 at 11:55
• I think you'd generally have to consider them all as weak - the protection for a PIN tends to come from a limit on the number of attempts allowed. If you can make 10,000 tries, you'll find the PIN. If you can only make 3 tries, you'd need more information to get lucky (maybe date of birth, favorite numbers or last time the team they support won a sporting event). There are still people around who use 0000 though... Jan 3, 2017 at 11:56
• @schroeder, thanks for the comment. Yes, I misspelled my question, your comment is very precise describes my question Jan 3, 2017 at 11:56
• Not especially - the search space is too small. The best you can do is to avoid PINs which will be tried early on by an attacker, but that then comes down to working out what order an attacker will try. Do they start at 0000, 0001, 0002...? 1379,1739, 1937...? (corner keys) 5000,4999,5001...? (middle of space, working out) 1234,1111,0000...? (most popular from 2012). If you restrict the use of weak ones, you cut the search space (blocking 100 PINs would reduce the space by 1%) which isn't good, when you start with a small space. Jan 3, 2017 at 12:06

There's no real way to do this beyond studying a real set of chosen PIN numbers by a large group of people and selecting the most common ones to be considered weak. At best you could use a statistical measure of information entropy, such as Shannon entropy or Markov probability, but with such a short sequence (4 digits) you're unlikely to get any kind of reasonable result.

The problem is that you're attempting to model a human problem algorithmically, which rarely works without very large data sets. Information entropy, as a rule, is unmeasurable directly due to the subjective definition of "information". Information is a human construct, and identifying a sequence of digits as having more information than its component numbers is a human process.

As an example, the number 7777 clearly contains a pattern, but 2701 looks like it doesn't contain any pattern at all. However, 2701 is actually the product of two primes, 37 and 73, which are the reverse of each other when written in base ten. If you didn't know this, the PIN number 2701 would appear devoid of any interesting information beyond its individual digits, but once you know that it has an interesting composition it suddenly has more information than you thought. Before reading this answer the number 2701 would probably have no special meaning to you, but others may have known of this quirk and seen it as a pattern. There's no easy way to look at someone and know whether they'd be aware of the composition of this number, or that they'd even be interested in it, let alone potentially use it as their PIN for something. As such you cannot easily determine whether there is an increased likelihood of them using that number.

The problem is confounded further by individuality issues: the day and month of my wedding anniversary has meaning to me, and certainly my wife, so it would be an obvious guess for an attacker who knows me, yet those same digits would hold no meaning to someone else. Again it falls down to the mindset of the individual.

This is the key problem: not only is it hard to classify what constitutes a "meaningful" number beyond some basic universal commonalities, but the answer also depends on the person who came up with the number, and the ability of the attacker to divine that person's sense of meaning. That's not a mathematical problem.

You can go one step further, too. Let's say a large bank accidentally leaks a full list of all the PIN numbers used by their customers - just the PINs, no associated names or account numbers. There are ten million records, so you go through and find each distinct PIN from 0000 to 9999 and count how many times each is used. You now know exactly how frequently a particular PIN might occur. This is cool research, so you publish the dataset online, and it makes it to some news sites where they explain what happened and talk about the most common PIN numbers, but also talk about the least common PIN numbers out there, including the single least frequently used PIN number. By publishing this article they automatically add informational weight to those numbers, leading a few people to change their PIN number and avoid common numbers, which changes the results. Maybe more people pick PINs from the list of least-chosen PINs, which now makes them more likely to be chosen. If you know someone read the article and changed their PIN, you'd want to check the list of least-used PINs according to that article.

As you can understand, the problem is complicated and not easily modeled. It relies upon individual human behaviours and personal choices. There is no one statistical or empirical measurement you can make of a PIN's strength beyond avoiding culturally common patterns (1111, 1234, 6969, etc.), and if you came up with an effective model it would invalidate itself anyway.