How Secure Is a Six-Digit PIN?

A six-digit PIN can be a practical way to unlock a device that limits failed attempts. It is a weak choice for a standalone account password or an encrypted file that lets an attacker test guesses without those limits.

There are 1,000,000 possible six-digit PINs when every digit from 0 to 9 is allowed, leading zeros are accepted, and digits can repeat. That is 100 times the search space of a four-digit PIN. The number matters, but so does what happens after a wrong guess.

What one million possibilities actually means

Each of the six positions has ten choices, so the calculation is 10⁶ = 1,000,000. A PIN uniformly selected from that unrestricted space has about 19.93 bits of entropy. This describes the selection process; a six-digit code chosen from a birthday does not automatically have that much unpredictability.

For a uniformly random PIN, one distinct guess has a one-in-a-million chance of success. Ten distinct guesses have a 0.001% chance, assuming the attacker has no information about the code. Those figures do not describe someone who knows your birthday or has watched you unlock your phone.

Why the device matters as much as the digits

A protected device can impose waiting periods, cap attempts, and bind verification to hardware. Apple documents increasing delays after failed passcode entries. This prevents the ordinary lock screen from behaving like an unrestricted guessing program.

These protections depend on the product, configuration, and whether an attacker can bypass them. A claim that every six-digit phone PIN takes a fixed number of seconds to crack leaves out the most important assumptions.

A chosen PIN is not necessarily a random PIN

Repeated digits, ascending sequences, dates, and keypad shapes are easy to remember and easy to prioritize. An attacker can try plausible choices before exploring the full million-code space.

Choose a PIN with a cryptographically secure generator rather than inventing a pattern. Keep the full output, including any leading zero. If the service rejects certain codes, generate a fresh code that meets its rules instead of modifying one into a memorable pattern.

When six digits are not enough

If someone obtains a verifier that can be tested offline, the service’s normal retry limits may no longer apply. The cost per guess then depends on the hashing or key-derivation scheme and hardware. A million candidates is a small search space for an unrestricted attack.

For an online account, use a long unique password or a passkey where available. For a device that supports longer unlock codes, additional random digits or a strong alphanumeric passcode provide more guessing resistance. If you need a secret you can memorize and the system accepts words, generate a random passphrase. Recovery settings and software updates also matter.

What the current PIN checker can tell you

The checker accepts 4–32 digits and preserves leading zeros. Length sets the starting grade; detected weaknesses can lower it. A six-digit PIN without a scored pattern starts at Strong, but that label is relative to PINs used with retry protections. It does not certify offline password strength or prove that the code was randomly selected.

Choose the keypad layout that matches where you enter the PIN. The checker supports telephone and computer layouts: straight lines receive the strongest keypad penalty, while simple corners, diagonal turns, and square perimeters receive a milder penalty. More complicated connected paths and patterns embedded in a longer PIN can appear as advisory notes without lowering the grade by themselves.

A whole six-digit value that could be a calendar date receives a date warning and caps the grade at Fair, unless another signal lowers it further. That is a possible interpretation, not proof that you chose a birthday. A genuinely random PIN can happen to resemble a date or shape; the warning does not establish how it was generated.

Common-list matches are another warning, not a verified global popularity ranking. The bundled lists do not cover every supported length, and their source and frequency ordering have not been verified. No match and no detected pattern are inconclusive, rather than proof of security.

A practical way to choose

Use at least six random digits when the device supports them, and consider a longer code for sensitive devices. Avoid reusing the same PIN for your phone, bank card, and other services: exposure in one place should not reveal them all.

A PIN strength checker can flag recognizable patterns. It cannot verify your device’s retry protections or promise a real-world cracking time. Treat its feedback as guidance about the code, not a guarantee about the system.

Related PIN guides

• How Many Possible Four-Digit PINs Exist?
• PIN vs Password: What Is the Difference?
• How Long Does It Take to Guess a PIN?