PIN Security
How Many Possible Four-Digit PINs Exist?
Updated October 27, 2026 · 6 min read
There are 10,000 possible four-digit PINs, from 0000 through 9999, if leading zeros and repeated digits are allowed. Each of the four positions has ten choices: 10 × 10 × 10 × 10 = 10,000.
A PIN is a sequence of digits, not necessarily a four-digit number. That distinction explains why 0007 counts as a four-digit PIN even though the number seven is usually written with one digit.
Why the answer is 10,000 rather than 9,000
The ordinary four-digit integers run from 1000 to 9999, giving 9,000 numbers. PIN systems that accept a zero in the first position add the 1,000 sequences from 0000 to 0999.
Order matters: 1234 and 4321 are different PINs. Repetition is normally part of the mathematical model, so 1111 also counts. Whether a particular service permits those choices is a separate question.
What if digits cannot repeat?
If leading zeros are allowed but no digit can appear twice, the first position has ten choices, the second nine, the third eight, and the fourth seven. The result is 10 × 9 × 8 × 7 = 5,040.
If the first digit must also be nonzero, the count becomes 9 × 9 × 8 × 7 = 4,536. If repetition is allowed but a leading zero is forbidden, the count is 9 × 10 × 10 × 10 = 9,000.
These are different rule sets. A service that blocks common codes has yet another allowed set. Removing predictable choices can help users avoid weak selections, but it does not enlarge the total search space.
How four digits compare with longer PINs
With unrestricted decimal digits, five positions give 100,000 possibilities, six give 1,000,000, and eight give 100,000,000. Every extra random digit multiplies the search space by ten.
Four uniformly random digits provide about 13.29 bits of entropy, calculated as log₂(10,000). This is a property of uniform random selection. It does not mean that every human-chosen four-digit PIN is equally hard to guess.
What the count means for guessing
One guess against a uniformly random four-digit PIN succeeds with probability 1/10,000, or 0.01%. Ten distinct guesses cover 0.1% of the space. Trying all 10,000 distinct candidates guarantees finding the code only if the system keeps allowing attempts and the code stays unchanged.
Human choices are not evenly distributed. Trying common patterns first can be more effective than counting upward from 0000. Conversely, a device that locks after a few failures may prevent an attacker from searching most of the space at all.
Do generator settings change the number of possibilities?
The standard PIN generator uses cryptographic randomness without excluding leading zeros or recognized patterns. For four digits, its unrestricted output space is the full 10,000 sequences. It uses rejection sampling when converting random bytes to digits so that the conversion does not favor particular digits.
The advanced generator optionally prevents a leading zero, reducing the four-digit space to 9,000. Its pattern-avoidance setting rejects candidates with scored warnings from the checker; advisory notes alone do not cause rejection. This is not the same as forbidding every repeated digit.
Pattern filtering selects from a smaller allowed set, whose size depends on the active rules. Do not describe a filtered four-digit output as uniformly selected from all 10,000 PINs, or treat 13.29 bits as its exact entropy. Excluding codes does not create additional combinations.
The checker’s random-selection maximum describes the unrestricted digit space, not entropy measured from a code you enter. Four digits start at Weak even when no recognizable pattern is found. A random four-digit code still needs the system’s retry protections.
Choosing within a four-digit limit
If a system only accepts four digits, generate a random PIN and avoid reusing it elsewhere. Do not use a birth year, an address fragment, or a familiar sequence. Keep the device or card itself secure, since its protections help compensate for the short secret.
If you can choose a longer PIN, additional random digits give you a larger search space. The combination count is a useful starting point, but the retry policy determines how much of that space an attacker can actually explore.
Related PIN guides
Choose a less predictable PIN
Generate a random PIN, or check a proposed code for recognizable patterns. Never enter a PIN you currently use into an unfamiliar tool.
