Why are PIN codes usually of even length (4 or 6)?

Question

A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday or year, either their own or relatives. There was even a case where a speaker had cracked the phone code of an audience live on-stage.

An odd-numbered PIN length seems like it would solve this (5-digits, for instance): even if the first two digits are mm/dd or dd/mm, now the user has to choose the last digit instead of just putting it as the two last digits of their birth year mindlessly. It might even discourage putting any kind of dates as a PIN and prompt them to choose a more random set of 5-digit numbers.

So my question: why are even-numbered PIN lengths the norm? Why 4 or 6 digits, why not 5 or 7 where they're much less tethered to how we write dates or years overall?

Answer 1

Great question! It got me thinking, which gets me researching.

I am theorizing that it's not an even vs. odd count as much as the recognized standard for PIN's (ISO 9564) states they should be between four and twelve digits long and recommended using four digits. I.e. that's why the four digit pin is so widely used. Then there are certain country financial institutions (Switzerland for example) that require six digit pins. Also, it's noted in the Wikipedia article that the ISO standard suggests issuing pins no longer than six digits. I believe recommendation of four digits and mandate of six digits by some institutions are why five digit pins are not as popular.

An analysis by DataGenetics on released/exposed/discovered password tables showed that four and six character pins are the most popular but all sizes of four or larger are used. From this analysis, it found that the most common five digit PIN (12345) in the sample appeared 22.802% of the time! That's about two times more than the most common four or six digit pin (1234 (10.713%) and 123456 (11.684%) respectively). I agree that using a five digit PIN to prevent using dates etc. is wise but in the US, postal zip codes are five digits and I could see people using them. Also, everyone with a single digit month birthday/anniversary etc. could easily use a mddyy PIN. The other interesting finding is the larger the PIN is, the more likely repetitive patterns begin to occur like 1234321 or 1212123. Key take away, the longer the pin the more humans will require a mnemonic to remember them.

References
ISO 9564
Pin Length
DataGenetics PIN Analysis

Answer 2

In the financial world, Binary-Coded Decimal is a popular number-storage format, since most major world currencies are divided into 100 cents, and BCD allows these to be stored as exact decimal numbers, versus binary floating-point where 0.01 is approximated as 0.00999999977648258209228515625 (in single-precision). BCD naturally organizes digits into pairs, and hence might explain the preference towards even numbers of digits.

Less speculative is why 4-digit PINs are particularly popular: You can thank (or blame) the ATM's inventor John Shepherd-Barron, and his wife's poor memory.

Initially, Barron also proposed 6-digit PINs, but when he tested this system on his wife, Caroline, she told him that the longest string of numbers that she could remember was 4. Consequently, he switched from 6-digit PINs to 4-digit ones, and ATMs became more popular. It wasn’t long before 4-digit PINs became the world standard.

Answer 3

PIN code lengths of five, seven, or eight+ digits are indeed good because they're nonstandard, which will combat PIN recycling. Any other justification seems to fall short.

PINs should always be implemented with a limited number of attempts allowed, banning automated PIN entry. The iPhone, for example, can be configured to wipe itself if you fail to enter your PIN ten times between unlocks. Banks will lock your account after a certain number of attempts. This isn't always the case, but I consider it necessary to counteract the ridiculously weak security PINs provide.

We're talking about trivial offline or automated cracking:

digits	combos	entropy	crack time
4	10k	13	0s
5	100k	16	0s
6	1m	20	2s
7	10m	23	17s
8	100m	26	3m
9	1b	30	28m
10	10b	33	5h
11	100b	36	2d

For a properly secure digital code, you'd need 14 digits for an offline crack time to exceed a year, and that's assuming something robust like PBKDF2 (this chart assumes PBKDF2 with a speed of 300k guesses/sec) rather than the vastly more likely plaintext code storage.

To this question's point, making it harder to map codes is better, as people so often conflate "random", "arbitrary", and "obscure", then fail spectacularly at estimating what is or is not obscure.

PINs with five or seven digits may avoid current patterns with four or six digits, but as kenlukas's answer points out, this will simply shift what people choose in their bad attempts at obscurity, such as postal codes or dates. There are 75% odds of a date that fits mddyy (or ddmyy) since there are only three months that miss (365 minus the days in October, November, and December is 273, 273/365 = 75%). Increase that to allow mmdyy/dmmyy and single-digit years between 2000-2009 and it gets worse.

An attacker can guess a ZIP code, for example, by using its ordered structure; if you're from a rural state or large metropolitan area, your ZIP code can be guessed in a few guesses because all codes in the area are similar. ZIP codes are therefore extremely insecure. At least with a mmdd code, there are 365.25 possibilities, though attackers will start with your and your loved ones' birthdays and anniversaries.

For dates, a six-digit code's 1000000 possibilities get reduced to 36525 and a birthdate can be narrowed to 1826 assuming you can guess the person's age within a five year span. (Five digit variations actually introduce complexity here, but it's not much.)

Seven-digit PINs will bring in the possibility of childhood phone numbers, which are at least harder for an attacker to socially engineer (especially for retired numbers).

Still, more is always better, so moving a requirement from four to five is great, but you might as well go to six. Aspire to longer codes barring compatibility concerns (I remember a conversation in 2002 in which a friend couldn't use their bank card in Europe because that bank didn't support six-digit PINs).

I'm hoping PINs fade away thanks to 2FA solutions like TOTP and HOTP, but I expect that transition to be slow and legacy support will continue for another decade or two.