Are You Making This Foolish PIN Password Mistake?

It doesn't take a rocket scientist to tell you most people are lax about password security...until its been compromised. Actually, it does take a (former) rocket scientist: Nick Berry formerly of Microsoft and current data privacy advocate crunched the numbers and discovered the sobering fact almost 11% of 4-digit PIN numbers rely upon "1234". He also discovered the least common 4-digit code, alongside some other unusual top #20 choices...

Pin it button big

The next most popular 4-digit PIN [after "1234"] in use is 1111 with over 6% of passwords being this.

In third place is "0000", with almost 2%.

A table of the top 20 found passwords in shown at the right. A staggering 26.83% of all passwords could be guessed by attempting these 20 combinations!

(Statistically, with 10,000 possible combination, if passwords were uniformly randomly distributed, we would expect the these twenty passwords to account for just 0.2% of the total, not the 26.83% encountered)

Looking more closely at the top few records, all the usual suspects are present 1111 2222 3333 ... 9999 as well as 1212 and (snigger) 6969 .

It's not a surprise to see patterns like 1122 and 1313 occurring high up in the list, nor 4321 or 1010 .

2001 makes an appearance at #19. 1984 follows not far behind in position #26, and James Bond fans may be interested to know 0007 is found between the two of them in position #23 (another variant 0070 follows not much further behind at #28).

And the least common 4-digit PIN? "8068", with only 25 occurrences in 3.4 million in Berry's dataset study. He does note it wouldn't be prudent to change your PIN to "8068" now the sequence has been publicly outed.

Other fascinating tidbits from Berry's very detailed (and equally entertaining) study:

  • For five digit passwords, users appear to have even less imagination in selecting their codes (22.8% select 12345). All the usual suspects occur, but a new addition is the puerile addition in position #20 of the concatenation of 420 and 69.
  • For six digit password, again 696969 appears highly. Also of note is 159753 (a "X" mark over the numeric keypad). James Bond returns with 007007.
  • For seven digits, the standby of 1234567 is a much lower frequency (though still the top). I speculate that this is because many people may be using their telephone number (without area code) as a seven digit password. Telephone numbers are fairly distinct, and already memorized, so when a seven digit code is needed, they spring to mind easily. The higher frequency of usage of telephone numbers reduces the need to use imagination (or lack thereof) and select something else.
  • Is Jenny there? The fouth most popular seven digit password is 8675309 (It's a popular 80's song).
  • Eight digit passwords are just as expected. Lots of pattern, and lots of repetition.
  • Common nine digit passwords also follow patterns and repetition. 789456123 appears as an easy "Along the top, middle and bottom of the keypad" 147258369 is related in the vertical direction (and other variants appear high up). Again we get a 420 moment with 420420420, and also the shaken, not stirred, but repeated 007007007 returns.
  • Interestingly for ten digits 1029384756 appears (alternating ascending/descending digits), as well as the odd/even 1357924680.
  • Hurrah for math! In position #17 of the ten digit password list we get 3141592654 (The first few digits of Pi)

Check out the Nick Berry's complete PIN Analysis post over at the DataGenetics blog.

(Image: Gregory Han)

25 Comments