an everyday code, decoded

The secret
life of PINs.

Why four digits guard your money, your phone, and your front door.

Scroll to explore how a bathtub idea became a global security habit

Two Scots. One quiet
revolution at the cashpoint.

In the mid-1960s, two inventors separately answered the same question: how can a machine safely know it is really you?

02 May 1966

James Goodfellow patents the coded plastic token and PIN pairing used by modern card systems.

Not just an
ATM ritual.

A PIN is a small secret with a very wide footprint. Open each field note for the system behind it.

Then: four digits. Now: many devices default to six, creating one million possible combinations instead of ten thousand.

The rulebook: ISO 9564. Your PIN should never be mailed with its card, stored in readable form, or transmitted without encryption.

Every four-digit
secret, mapped.

Ten thousand possible PINs. Not ten thousand equally likely choices.

3.4m

PINs in the original DataGenetics analysis of leaked codes.

99first two digits00
00last two digits99
birthdate
band
“19xx” birth-year stripe
PIN / 1234extremely common
Try a known pattern
Most commonLeast common

Each square is one possible PIN: the first two digits run top-to-bottom; the last two run left-to-right. Move over the grid or use arrow keys to inspect it.

01

Familiar wins

1234 alone represented roughly 10–11% of analyzed PINs. The first three—1234, 1111 and 0000—made up more than 18%.

02

Dates leave tracks

The bright diagonal comes from DD/MM or MM/DD birthdays. The stripe at 19 points to birth years used as PINs.

03

Patterns persist

A 2025 dark-web analysis found the same habits: repeated digits, birth years, and 1234 still at the top.

Often chosen

  1. 011234
  2. 021111
  3. 030000
  4. 041212
  5. 057777
  6. 061004
  7. 072000
  8. 084444
  9. 092222
  10. 106969

Lower-frequency examples

  1. 018068
  2. 028093
  3. 039629
  4. 047637
  5. 050738
  6. 068398
  7. 076793
  8. 088557
  9. 098438
  10. 109539

a last check

Your PIN should be
hard to guess, not hard to remember.

Try the pattern check

Nothing is saved or sent. This only checks familiar patterns illustrated on this page.