How secure is a 4 digit numbers only captcha?

How many tries will take to be able to bruteforce that captcha?

  • 1
    I voted to close this as too broad. As mentioned in my answer, it "depends on whether you limit attempts per IP, or per account, or how many attempts per second can be done in the first place, etc." Please clarify whether you're just looking for the average number of attempts required if one is purely guessing, or if your specific question is about something else.
    – Luc
    Nov 27 '19 at 19:55

Like 7, if the attacker is very lucky, or 70000, if the attacker is very unlucky. So whether this is "secure" depends on whether you limit attempts per IP, or per account, or how many attempts per second can be done in the first place, etc. It seems fairly obvious that with 9999 being the highest number, there are ten thousand possible values (since all zeroes is one of the options, 9999+1). If you guess randomly, you'll have a 1 in 10 000 chance of getting it right. After 10k attempts, you've got 50% chance of having guessed one right. There are a lot of questions on this site alone where these calculations are already done (looking for it is faster than waiting half an hour for someone to explain it yet again). How long this average of 10k attempts will take depends entirely on your circumstances. Furthermore, how difficult a CAPTCHA is, typically does not really depend on how many possible values there are, unless it's weirdly low like 4 digits and it actually might start to matter. Generally, it has to be quite unreadable before it cannot simply be determined (decoded from the image or audio file) rather than blindly guessed.

  • So you are saying that for a simple 4 digit 0-9 captcha should take 10 000 attempts? It looks like something that can be done in 2/3 hours.
    – Pong
    Nov 27 '19 at 19:52
  • 1
    @Pong That depends on how many attempts per second the server can handle and if it doesn't block after a certain number of invalid attempts. And I said it takes an average of 5000 attempts, but may also be 70000 if the attacker is unlucky. And indeed, two thirds of an hour may be accurate, or it may not be. Why don't you try?
    – Luc
    Nov 27 '19 at 19:54
  • @Pong there are 10 000 possibilities, not 10 000 attempts. So in average, it should take 5000 attempts to break it (with no rules about blocking IP, or blocking bruteforcing). Some captcha will change after a few numbers of attempts, so it becomes even harder to break it. Anti-bruteforce and IP blocking will make it harder too
    – Deunis
    Nov 28 '19 at 9:14
  • @Deunis: I suspect the average is 10.000 attempts, not 5000. The captcha is dynamically generated each time, so on the second attempt you cannot exclude the number you tried on the first attempt. 5000 attempts is the average against a fixed captcha. The difference becomes obvious when you consider what the chance is that you need 10001 attempts. With a static captcha, that chance is zero, but the chance is non-zero when you get 10001 different captcha's to guess.
    – MSalters
    Nov 28 '19 at 10:44
  • @MSalters I think you're right! (link to small JS simulation). I corrected the answer, let me know if you spot any other mistakes.
    – Luc
    Nov 28 '19 at 13:08

Doing some research yields some interesting information:

Probably the most easy to follow is the YouTube video "What is the probability of guessing a 4 digit pin code?" that explains how to determine the probability of guessing a 4 digit PIN (it's 1 in 10,000).

There are other conversations about permutations reducing the potential combinations, but the probability still seems to be the same.

The trick would be to limit the number of failed attempts in order to minimize the brute force potential.

Reference: Trefor Bazett's YouTube Channel, the specific video addressing the question is referenced above.

Not the answer you're looking for? Browse other questions tagged or ask your own question.