Find out if you’re one of them.
The last line of security for much of your digital life probably isn’t as secure as you think.
Whether it’s to unlock your smartphone, access your online banking or get cash out of the ATM, a four-digit PIN is often there to keep your secrets and your money safe.
It’s an important little code, but not all choices are equally secure.
That’s why we analysed 29 million of them from Have I Been Pwned? – an Australian-run site that helps people all over the world find out if they’ve been affected by data breaches.
The most commonly used PINs turned out to be staggeringly popular, meaning they’re particularly easy to guess when phones and bank cards fall into the wrong hands.
This grid of green squares might remind you of an old Space Invaders game, but it’s actually something like a mind-reader.
It’s going to let us peer inside and find out why humans choose some PINs more than others.
Every square in the grid represents a four-digit code.
We’ve highlighted 4560 as an example to get you across how it works.
The grid is arranged by splitting the digits of each code into pairs.
The first two digits (45) are taken from the vertical axis, and the last two digits (60) are from the horizontal one.
The brighter the square, the more popular the code – which means the blocks of bright squares are the ones we need to avoid when choosing a PIN.
So, which number is the clear favourite? Chances are you’ve used it at some stage.
1234 is the most popular choice by a huge margin, accounting for nearly one in 10 of the millions of PINs we looked at.
And then there’s the diagonal line running from the bottom-left corner to the top-right one.
It stands out, and that’s because it’s made up of PINs that use repeated digits…
… like 0000, which is the second most popular code.
And right behind it is 1111.
1212 and 4444 are in the top ten as well.
There’s also a (broken) horizontal line, split between 19 and 20 for the first two digits.
What does that remind you of?
They are the birth years of people who are alive today.
1986 is the most popular of these, while 2004 is also in the top 20.
There’s also a block-ish area around the bottom left that needs some explaining.
These are all the combinations that could represent dates like 2512.
2902 is not as popular as its neighbours, but that’s probably because it only comes around once every four years.
If you live in the United States, you’d be using 0229 instead.
This explains the slightly less prominent, yet almost perfectly symmetrical grid overlapping the other one.
But what about the other popular codes that don’t fall on any of these special lines or grids?
The reason for choosing 4321 is no real mystery. It’s just 1234 in reverse.
Some people have tried to be clever; they’ve mixed things up by choosing 1342.
So many of them, in fact, that it’s the 4th most popular code of all.
2580 might seem like a strange one to be in the top 40…
…until you realise it draws a line directly down the keypad on a phone.
It makes sense why some four-digit codes are chosen again and again, but this phenomenon brings with it a serious security risk.
Even though there are 10,000 possible combinations, when humans get involved that equation changes dramatically.
If someone wants to unlock a stolen phone – or retrieve money from an ATM – and only have five guesses, this data suggests they still have a one-in-eight chance of guessing correctly.
And, while it’s harder to visualise, there is a similar weakness to be found in regular passwords too.
1234 was as high as fourth on a list of common passwords compiled by NordPass VPN.
Even when people have the entire keyboard to choose from, the only choices that were more popular were 123456, “admin” and “password”.
All in all, it paints a worrying picture of the last line of defence for our digital lives.
Earlier this year, journalists attending a briefing at the UK’s National Cyber Security Centre (NCSC) were given a security code to access the building’s facilities.
The code they were given was 1234.
The NCSC later clarified this was only a temporary code used for the briefing.
And there’s a lesson in that: if you’re one of the millions of people using an ill-advised PIN, perhaps yours should be temporary too.
Remember, it’s never too late to change yours to something more secure.
The top 50 codes to avoid
These are the 50 most popular codes in the full Have I Been Pwned? dataset, in order of popularity.
| Ranking | Code | Popularity |
|---|---|---|
| 1 | 1234 | 9.0% |
| 2 | 1111 | 1.6% |
| 3 | 0000 | 1.1% |
| 4 | 1342 | 0.6% |
| 5 | 1212 | 0.4% |
| 6 | 2222 | 0.3% |
| 7 | 4444 | 0.3% |
| 8 | 1122 | 0.3% |
| 9 | 1986 | 0.3% |
| 10 | 2020 | 0.3% |
| 11 | 7777 | 0.3% |
| 12 | 5555 | 0.3% |
| 13 | 1989 | 0.3% |
| 14 | 9999 | 0.2% |
| 15 | 6969 | 0.2% |
| 16 | 2004 | 0.2% |
| 17 | 1010 | 0.2% |
| 18 | 4321 | 0.2% |
| 19 | 6666 | 0.2% |
| 20 | 1984 | 0.2% |
| 21 | 1987 | 0.2% |
| 22 | 1985 | 0.2% |
| 23 | 8888 | 0.2% |
| 24 | 2000 | 0.2% |
| 25 | 1980 | 0.2% |
| 26 | 1988 | 0.2% |
| 27 | 1982 | 0.2% |
| 28 | 2580 | 0.2% |
| 29 | 1313 | 0.2% |
| 30 | 1990 | 0.2% |
| 31 | 1991 | 0.2% |
| 32 | 1983 | 0.2% |
| 33 | 1978 | 0.2% |
| 34 | 1979 | 0.2% |
| 35 | 1995 | 0.2% |
| 36 | 1994 | 0.2% |
| 37 | 1977 | 0.2% |
| 38 | 1981 | 0.2% |
| 39 | 3333 | 0.2% |
| 40 | 1992 | 0.2% |
| 41 | 1975 | 0.2% |
| 42 | 2005 | 0.2% |
| 43 | 1993 | 0.2% |
| 44 | 1976 | 0.2% |
| 45 | 1996 | 0.2% |
| 46 | 2002 | 0.2% |
| 47 | 1973 | 0.2% |
| 48 | 2468 | 0.2% |
| 49 | 1998 | 0.1% |
| 50 | 1974 | 0.1% |
- 1234
- 1111
- 0000
- 1342
- 1212
- 2222
- 4444
- 1122
- 1986
- 2020
- 7777
- 5555
- 1989
- 9999
- 6969
- 2004
- 1010
- 4321
- 6666
- 1984
- 1987
- 1985
- 8888
- 2000
- 1980
- 1988
- 1982
- 2580
- 1313
- 1990
- 1991
- 1983
- 1978
- 1979
- 1995
- 1994
- 1977
- 1981
- 3333
- 1992
- 1975
- 2005
- 1993
- 1976
- 1996
- 2002
- 1973
- 2468
- 1998
- 1974
About this story
- This visualisation was inspired by similar work from Nick Berry in 2013
- The popularity of each PIN code was retrieved from Have I Been Pwned’s pwned passwords API, which includes passwords leaked from a variety of sources and likely contains duplicate data. While it isn’t a perfect data set, it aligns with likely usage patterns, even if it’s just because people repeat their PIN codes on their computers.
Credits
- Reporting and development: Julian Fell
- Design: Teresa Tan
- Editing: Cristen Tilley
