PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269.

My knowledge about password security is limited and I have not found any information about this. While these PINs are not completely random it seems to me that they should be (depending on words) quite secure†, at least for what PINs usually protect (just 4--8 numbers) and with other measures such limited attempts.

† I just realized that 0 and 1 are not mapped to letters, so those might have to be interspersed at random.


  1. Can anything be said directly about the security of PINs that spell out words?

  2. Has any research or attacks been made regarding these kinds of PINs?

  • If you'd like, I can try to find the paper, but there was research that showed that 4 digit pins actually have better security than 6 digit pins, because people chose them poorly. I would imagine this scheme would help with that. – Ryan Amos Apr 17 at 19:00
  • @RyanAmos Yes please, that would be interesting. – Klorax Apr 17 at 21:17

The concept you are looking for is "entropy" and the selection process for passwords.

For PINs, people tend to use well-known numbers or patterns (1111, 1066 (very common in the UK), 1337 (popular with gamer males), etc). These have very low entropy and are easy to guess. These are the equivalent of password1. If you leave the selection process up to humans, they will default to something very easy to remember and likely something that many other people will use, too.

Getting people to think about another PIN selection process helps to increase entropy. Random is best, of course, but translating the process to words widens the scope of selection options.

The number set is the same (8 characters 0-9), so a plain brute-force is the same, but known patterns make the process so much faster.

So, given that random PIN selection is likely not going to happen in practice, and recognizing that people need a nudge towards better PIN selection processes, nudging people towards words is a generally good thing. Far better than meaningful dates or re-used PINs.

| improve this answer | |
  • Your conclusion is similar to mine. When you write "8 characters 0-9" I assume you account for 0-1 that I missed at first, but that makes it weaker to brute-force? Also, seeing this relation as a function, it seems to be one-way, but how good is it, e.g., are there any known dictionary attacks? Thanks! – Klorax Mar 21 at 13:52
  • Of course there are dictionary attacks. There are dictionary translators that can change letters to their number pad equivalents, too. Note that various number pads have different letter assignments. On many phone numebr pads, numbers 7 and 9 have four letters, but some move 2 of those letters to the 1 key. Does limiting the symbol set to 2-9 reduce entropy? Sure. But the underlying principles are the same as what I've written. – schroeder Mar 21 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.