How Long Does It Take to Guess a PIN?

There is no single time to guess a PIN. A four-digit code has 10,000 possible values and a six-digit code has 1,000,000, but the time depends on how many guesses an attacker can make and whether the system stops them.

Any estimate should state its assumptions. Guessing at an ordinary device lock screen is very different from testing a stolen verifier offline. A common PIN may also be found much earlier than a random one.

The formula for an unrestricted search

For an n-digit decimal PIN with leading zeros and repetition allowed, there are N = 10ⁿ candidates. At a constant rate of r distinct guesses per second, an exhaustive search takes up to N/r seconds, assuming the correct candidate is tested last.

If the PIN is uniformly random and guesses do not repeat, the expected number of attempts is (N + 1)/2. Expected time is therefore (N + 1)/(2r). This is an average over possible PINs, not a deadline or a guarantee.

Four-digit PIN: illustrative times

At one guess per second, testing all 10,000 candidates takes 2 hours, 46 minutes, and 40 seconds. Expected time for a uniformly random PIN is about 1 hour, 23 minutes, and 21 seconds.

At 10 distinct guesses per second, the full space takes 16 minutes and 40 seconds, with an expected time of about 8 minutes and 20 seconds. At 1,000 per second, the full search takes 10 seconds and the expected time is about 5 seconds. These are arithmetic scenarios with unlimited attempts, no waiting periods, and a constant rate. They are not measured results for a phone, bank card, or service.

Six-digit PIN: illustrative times

At one guess per second, exhausting one million candidates takes about 11 days and 14 hours. Expected time is about 5 days and 19 hours.

At 10 distinct guesses per second, the full search takes 27 hours, 46 minutes, and 40 seconds, with an expected time of about 13 hours, 53 minutes, and 20 seconds. At 1,000 per second, those values become 16 minutes and 40 seconds, and about 8 minutes and 20 seconds.

These rates are hypothetical inputs to the formula. Six random digits provide 100 times as many candidates as four random digits, so the same unrestricted search takes about 100 times as long.

Why real devices do not follow a simple stopwatch

Devices and services can delay retries, disable access, or require recovery after failures. Apple’s platform security documentation describes escalating delays after invalid passcodes. A constant-rate calculation cannot represent those controls.

If an attacker has only ten distinct attempts, the success probability against a uniformly random four-digit PIN is 0.1%; for six digits it is 0.001%. This assumes the attempt limit cannot be bypassed or reset and no other information narrows the choices. It is a probability calculation, not a prediction of a particular device’s behavior.

Offline attacks change the assumptions

If a stolen hash or encrypted object permits offline verification, online lockouts may not constrain the search. The actual rate depends on the verifier, key-derivation cost, hardware, and any device-bound protections. Some protected credentials cannot be checked with a simple exported hash.

Never apply a fast offline rate to every phone, or a phone’s lockout policy to every encrypted file. To give a meaningful time estimate, first identify what the attacker has and where guesses are checked.

How to interpret the current checker’s time cards

The checker shows hypothetical uninterrupted full searches at 10 and 1,000 attempts per second. Each card divides the unrestricted space, 10ⁿ, by the selected rate. It is a full-space illustration, not the average time to find your PIN, a measured device benchmark, or an estimate derived from the grade.

The displayed calculation does not shrink the space to account for a detected date, keypad shape, or common-list match. Attackers may prioritize such choices. The list position is not a verified guessing rank, so it cannot justify a precise time-to-guess claim either.

The average-time formula earlier in this article assumes uniform selection and distinct guesses. For a filtered generator, use the size of its actual allowed set if known, rather than automatically substituting 10ⁿ. For a human-chosen code, the selection probabilities may be uneven, so half the full space need not describe the expected attack.

An advisory note is not a new timing measurement. The current checker distinguishes scored whole-PIN patterns from partial-pattern or complex-path notes. Neither the presence nor absence of such a note reveals an attacker’s actual guess rate or your device’s retry policy.

Reduce the attacker’s useful guesses

Choose a random PIN, use more digits when supported, keep devices updated, and avoid sharing the same code across services. A predictable PIN undermines the random-search assumptions because an attacker can prioritize likely choices.

A PIN strength checker can identify patterns, but it cannot know every device protection or attacker capability. Use its results to improve your choice and rely on the device’s documentation for its actual retry and recovery behavior.

Related PIN guides

• How Secure Is a Six-Digit PIN?
• How Many Possible Four-Digit PINs Exist?
• PIN vs Password: What Is the Difference?