29

A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday or year, either their own or relatives. There was even a case where a speaker had cracked the phone code of an audience live on-stage.

An odd-numbered PIN length seems like it would solve this (5-digits, for instance): even if the first two digits are mm/dd or dd/mm, now the user has to choose the last digit instead of just putting it as the two last digits of their birth year mindlessly. It might even discourage putting any kind of dates as a PIN and prompt them to choose a more random set of 5-digit numbers.

So my question: why are even-numbered PIN lengths the norm? Why 4 or 6 digits, why not 5 or 7 where they're much less tethered to how we write dates or years overall?

New contributor
jonvyltra is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
5
  • 9
    about 15 years ago I got an account with a bank that had 5-digit PIN codes... a while after that I moved and got a new account at a different bank and entered a new 5 digit code. Could never get the ATM to recognize my PIN even after changing it more than once. Turned out I was entering 5 digits but it only wanted 4 - nobody told me!
    – Michael
    Aug 5 at 16:12
  • 4
    If I think of a number (phone number, e.g.) usually I think in groups of 2 numbers. 31, 57, 89 is just as easy to remember (to me) as 31, 57, 8. Perhaps just personal preference, but I feel like I can't be the only one. Aug 5 at 22:01
  • 3
    For what it's worth. I have two different mobile banking apps that require a 5 digit pin for login. And also an app (DigiD) for identification by government agencies that also requires a 5 digit pin. It seems that for mobile apps where security is important they do often require that.
    – Ivo
    Aug 8 at 6:57
  • @Ivo I have the same with my apps (also Dutch) I suspect in these cases of bank apps they use 5 digits to prevent people from reusing their "real" pin code
    – Joost K
    Aug 8 at 8:19
  • I've got a flimsy 5-digit bike lock as the secondary lock on a cheap bike. That's set to DDMMY (the Y being the decade so DDMMYY omitting the last Y) of a memorable date, though not my birthday, from when it was shared between family members. This is a trivial way to generate a 5-digit PIN with no more randomness than suggested by a 4- or 6-digit. Obviously this approach would be really bad with anything traceable to my ID and isn't recommended
    – Chris H
    Aug 8 at 9:36

3 Answers 3

26

Great question! It got me thinking, which gets me researching.

I am theorizing that it's not an even vs. odd count as much as the recognized standard for PIN's (ISO 9564) states they should be between four and twelve digits long and recommended using four digits. I.e. that's why the four digit pin is so widely used. Then there are certain country financial institutions (Switzerland for example) that require six digit pins. Also, it's noted in the Wikipedia article that the ISO standard suggests issuing pins no longer than six digits. I believe recommendation of four digits and mandate of six digits by some institutions are why five digit pins are not as popular.

An analysis by DataGenetics on released/exposed/discovered password tables showed that four and six character pins are the most popular but all sizes of four or larger are used. From this analysis, it found that the most common five digit PIN (12345) in the sample appeared 22.802% of the time! That's about two times more than the most common four or six digit pin (1234 (10.713%) and 123456 (11.684%) respectively). I agree that using a five digit PIN to prevent using dates etc. is wise but in the US, postal zip codes are five digits and I could see people using them. Also, everyone with a single digit month birthday/anniversary etc. could easily use a mddyy PIN. The other interesting finding is the larger the PIN is, the more likely repetitive patterns begin to occur like 1234321 or 1212123. Key take away, the longer the pin the more humans will require a mnemonic to remember them.

References
ISO 9564
Pin Length
DataGenetics PIN Analysis

9
  • 4
    @AdamKatz for non-US, you don't have to use dmmyy, you can still use the analogous ddmyy. Or any other variation, such as ddmmy or whatever. Besides, apparently a lot of countries have 5-digit postal codes. Aug 5 at 16:07
  • 7
    Emphasis on a citation in the Pin Length link: The inventor of the ATM, John Shepherd-Barron, had at first envisioned a six-digit numeric code, but his wife could only remember four digits, and that has become the most commonly used length in many places. It started as 4 for a very empiric reason! Aug 5 at 16:14
  • 1
    Funny that you mention ZIP codes because when I had an ATM card that required 5 digits I used that! But I didn't use the ZIP code of where I lived, I have this hobby of remembering ZIP codes of obscure places across the country that I have been or just happened to look up... Great thing about this is that if you remember the PIN you can usually remember the place and look up the ZIP code.
    – Michael
    Aug 5 at 16:15
  • 1
    @Michael "I have this hobby of remembering ZIP codes of obscure places across the country that I have been or just happened to look up..." The problem I'd have with that is remembering which of the couple dozen obscure places is my PIN tied to... Aug 5 at 16:18
  • 8
    ZIP codes are structured, so if you know a code near a location you want to guess, you can probably get the target code in a few guesses. This is quite similar to using birthdates. You know a person's birthday and just have to guess the year, or you know the approximate age and can reduce a six-digit pin's complexity down from 1m to 2000 (five years is 1826 days).
    – Adam Katz
    Aug 5 at 17:25
13

In the financial world, Binary-Coded Decimal is a popular number-storage format, since most major world currencies are divided into 100 cents, and BCD allows these to be stored as exact decimal numbers, versus binary floating-point where 0.01 is approximated as 0.00999999977648258209228515625 (in single-precision). BCD naturally organizes digits into pairs, and hence might explain the preference towards even numbers of digits.

Less speculative is why 4-digit PINs are particularly popular: You can thank (or blame) the ATM's inventor John Shepherd-Barron, and his wife's poor memory.

Initially, Barron also proposed 6-digit PINs, but when he tested this system on his wife, Caroline, she told him that the longest string of numbers that she could remember was 4. Consequently, he switched from 6-digit PINs to 4-digit ones, and ATMs became more popular. It wasn’t long before 4-digit PINs became the world standard.

New contributor
dan04 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • 4
    BCD does seem a likely factor, although the idea that it "naturally organizes digits into pairs" could do with some expansion. Specifically, a single digit in BCD takes up 4 bits, so a pair of them is natural in a system optimised for 8-bit operations; moreover, four digits of BCD is optimal in a system optimised for 16-bit operations, which seems plausible for a 1960s device. I'm not sure how much stock to put on the Shepherd-Barron anecdote.
    – IMSoP
    Aug 7 at 16:06
7

PIN code lengths of five, seven, or eight+ digits are indeed good because they're nonstandard, which will combat PIN recycling. Any other justification seems to fall short.

PINs should always be implemented with a limited number of attempts allowed, banning automated PIN entry. The iPhone, for example, can be configured to wipe itself if you fail to enter your PIN ten times between unlocks. Banks will lock your account after a certain number of attempts. This isn't always the case, but I consider it necessary to counteract the ridiculously weak security PINs provide.

We're talking about trivial offline or automated cracking:

digits combos entropy crack time
4 10k 13 0s
5 100k 16 0s
6 1m 20 2s
7 10m 23 17s
8 100m 26 3m
9 1b 30 28m
10 10b 33 5h
11 100b 36 2d

For a properly secure digital code, you'd need 14 digits for an offline crack time to exceed a year, and that's assuming something robust like PBKDF2 (this chart assumes PBKDF2 with a speed of 300k guesses/sec) rather than the vastly more likely plaintext code storage.

To this question's point, making it harder to map codes is better, as people so often conflate "random", "arbitrary", and "obscure", then fail spectacularly at estimating what is or is not obscure.

PINs with five or seven digits may avoid current patterns with four or six digits, but as kenlukas's answer points out, this will simply shift what people choose in their bad attempts at obscurity, such as postal codes or dates. There are 75% odds of a date that fits mddyy (or ddmyy) since there are only three months that miss (365 minus the days in October, November, and December is 273, 273/365 = 75%). Increase that to allow mmdyy/dmmyy and single-digit years between 2000-2009 and it gets worse.

An attacker can guess a ZIP code, for example, by using its ordered structure; if you're from a rural state or large metropolitan area, your ZIP code can be guessed in a few guesses because all codes in the area are similar. ZIP codes are therefore extremely insecure. At least with a mmdd code, there are 365.25 possibilities, though attackers will start with your and your loved ones' birthdays and anniversaries.

For dates, a six-digit code's 1000000 possibilities get reduced to 36525 and a birthdate can be narrowed to 1826 assuming you can guess the person's age within a five year span. (Five digit variations actually introduce complexity here, but it's not much.)

Seven-digit PINs will bring in the possibility of childhood phone numbers, which are at least harder for an attacker to socially engineer (especially for retired numbers).

Still, more is always better, so moving a requirement from four to five is great, but you might as well go to six. Aspire to longer codes barring compatibility concerns (I remember a conversation in 2002 in which a friend couldn't use their bank card in Europe because that bank didn't support six-digit PINs).

I'm hoping PINs fade away thanks to 2FA solutions like TOTP and HOTP, but I expect that transition to be slow and legacy support will continue for another decade or two.

Your Answer

jonvyltra is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.