Results
This page was last re-built on 2024-11-12 09:38:07 UTC.
Freshly generated, “secure” PINs
Here are ten PINs, freshly generated by your browser: LOADING
Don't like these numbers? Click here to re-roll instead of modifying the numbers yourself!
Of course, ideally you shouldn't trust some random guy on the internet to provide you with a “secure” PIN. Instead, you should either let your bank generate PINs for you, or write a PIN generator yourself, or even roll 4 ten-sided dice. I won't take any responsibility if you use any of the above PINs, and something bad happens to your account/money/pet. Please use common sense. And for the love of god, don't use 1234
as a PIN, or any other very popular PIN!
Top 10 PINs
The most popular are (most to less popular): 1234, 1111, 0000, 1342, 1212, 2222, 4444, 1122, 1986, 2020
If you use any of these PINs for anything that needs to the slightest bit of security, please do yourself a favor and change it immediately.
Interactive PIN map
General observations
- Yes, 1234 is still a terrible PIN, just like other “obvious” progressions, quadruple-digits, or anything that could be a MMDD, DDMM, or YYYY date.
- I'm especially disappointed in the continued trend of birthyears being used.
- 69/420/666 is still reasonably popular, but lucky number 7 seems to have fallen out of fashion.
- The “telephone layout” (PINs 2580 and 0852; 52835+7315=60150 uses) is still more popular than the “numpad layout” (PINs 8520 and 0258; 12642+6021=18663 uses). This seems to confirm datagenetics' finding that these PINs might indeed be used for more serious things (e.g. banking contexts).
Download
- Download
table.json
: Maps each PIN to its SHA1 hash, which makes it easier to look it up on HIBP. - Download
list.json
: A list that contains 10000 numbers, each indicating how often each PIN was found in the HIBP dataset. You could use that file to make your own interactive graphic, or PIN generator. - Download
probabilities.json
: A comparison how well each PIN generation approach fares against each possible attacker.
Background
Inspiration
I recently read a nice blog post by datagenetics.com (Nick Berry?), from about September 2012. It tells the story of how password leaks happen, that they contain PINs, and lots of interesting analysis on them.
However, a long time has passed since September 2012, and in the end I had several questions:
- Is 1234 still the most popular password?
- The birthyears were very well visible in his dump – they should have shifted by now, right?
- What's that spot? And that other spot? Can't you make an interactive version please, where it shows you the number when you hover with the mouse or something?
- And where's the machine-readable data?
- Is the "bank PIN" conclusion still applicable?
- This dataset would be a fantastic starting point to make a PIN recommendation generator! Where is it?
- Can you make it self-updating maybe?
This page scrapes the data from Have I Been Pwned and answers all of these questions! :)
On PIN generation schemes
At first glance, picking a PIN uniformly at random seems like the best approach: Each PIN would have exactly the same probability, meaning the probability that an attacker can successfully guess your PIN is as low as possible.
However, we already know that the attacker is very likely going to prioritize certain numbers over other numbers. In particular, we can reasonably expect that the attacker will use one of the following approaches, or a combination thereof:
- The attacker might simply try the three most popular PINs. If the attacker has three tries, this would have a success rate of (2633239+460710+327795)/29226424 = 11.7% when used on the general population! A frightening reminder not to use those PINs for any of your bank cards. Let's call this approach
top3
. - Or perhaps the attacker is just trying out truly uniformly random PINs. Let's call this approach
uni
. - Perhaps the attacker computed similar statistics as this blog post, and randomly tries PINs, weighted accordingly. Let's assume that the attacker observes similar numbers – this is easily justified because I got basically the same numbers as a blog post from 2012. Let's call this approach
real
. - Perhaps the attacker has read this blog post, and randomly tries PINs with the same weighting as the above PIN generator. This is somewhat unlikely, but it's a good sanity check to see if the “secure” PIN generator accidentally makes things less secure. Let's call this approach
invreal
. (Spoiler: Yes, of course it is less secure than “uniform random” according to some metrics; however, it is more secure in other metrics. Deciding which ones to use is the the whole point of this subsection.)
The following table compares the chances of success given each pairing of PIN generation and attacker. The variant top1
always guesses 1111
, and top10
always guesses the top ten most popular PINs, weighted according to real-life use. Note that PIN generator and attacker are interchangeable, so pick your favorite interpretation of the axes:
real | top1 | top3 | top10 | uni | invreal | |
---|---|---|---|---|---|---|
real | 0.887% | 9.010% | 7.253% | 6.094% | 0.010% | 0.006% |
top1 | 9.010% | 100.000% | 76.956% | 63.990% | 0.010% | 0.000% |
top3 | 7.253% | 76.956% | 61.953% | 51.514% | 0.010% | 0.000% |
top10 | 6.094% | 63.990% | 51.514% | 43.280% | 0.010% | 0.000% |
uni | 0.010% | 0.010% | 0.010% | 0.010% | 0.010% | 0.010% |
invreal | 0.006% | 0.000% | 0.000% | 0.000% | 0.010% | 0.012% |
Keep in mind that there are 10000 possible PINs, so a result of 0.010% is perfect, and something slightly worse (perhaps up to 0.050%) could be considered acceptable in many situations. Note that even if the attacker knows that you are using this approach, this only means that he can raise his chances from 0.010% to COMPUTING, a miniscule step.
Anyway, I hope you see this as strong evidence the invreal
method is reasonably good. Again, I don't take responsibility if something goes wrong due to this, but I think this approach is much better than using the brain's random-number generator, and probably quite a bit better than using uniformly-random PINs.