How Long Should Your PIN Be? 4 vs 6 Digits, Explained

Short answer: six digits, chosen at random

A 6-digit PIN is stronger than a 4-digit one, but only if it isn't predictable. So how long should your PIN be? Six digits at minimum, and just as important, digits nobody could guess. Below is the math, and why it only tells half the story.

The raw math: 10,000 vs 1,000,000

Every extra digit multiplies the number of possible PINs by 10. A 4-digit PIN has 10,000 combinations. A 6-digit PIN has 1,000,000.

With no limit on guessing, that gap is the whole defense. ElcomSoft's analysis of old iPhones with no Secure Enclave, such as the iPhone 5 and 5c, found guessing ran at about 13.6 attempts per second. At that speed, every 4-digit PIN falls in about 12 minutes and every 6-digit PIN in up to 21 hours. Length helps. Still, a million combinations is small change for a computer that can try them all.

Modern iPhones work differently.

Why throttling changes the math

On current iPhones, the passcode is tied to the device's own hardware key (the UID), so guesses can only be made on the phone itself. Apple's platform security guide says each attempt is calibrated to take about 80 milliseconds, and the Secure Enclave enforces escalating delays. Restarting the phone won't skip a delay.

Apple's published schedule:

• Attempts 1 to 3: no delay
• After attempt 4: 1 minute
• After attempt 5: 5 minutes
• After attempt 6: 15 minutes
• After attempt 7: 1 hour
• After attempt 8: 3 hours
• After attempt 9: 8 hours
• After attempt 10 or more: the device stays locked until it is connected to a Mac or PC

If you turn on Erase Data, the phone also wipes itself after 10 consecutive wrong entries. Repeating the same wrong PIN doesn't count toward the limit.

With delays like these, ElcomSoft estimates about 416 days to try every 4-digit PIN and about 114 years for every 6-digit PIN. Its delay table differs slightly from Apple's current one, so read those figures as a rough order of magnitude, not a promise. They also assume nobody bypasses the delays. Where exploits against the Secure Enclave exist on some older chips, ElcomSoft notes guessing speeds range from roughly 4 attempts a minute to about 30 a second. For more on what a locked phone does and doesn't protect, see what your iPhone's lock state protects.

People don't pick randomly

That 114-year figure assumes an attacker works through PINs in order from 000000. Real attackers don't. They start with the likely ones.

ElcomSoft's data on real-world 4-digit PINs shows 1234 accounts for about 10.7%, 1111 for about 6.0%, and 0000 for about 1.9%. The 20 most common PINs together cover 26.83%. Someone who gets only a handful of tries still has a good chance against a lazy PIN.

Researchers at the IEEE Symposium on Security and Privacy looked at this directly. In "This PIN Can Be Easily Guessed", they analyzed 1,220 user-chosen 4- and 6-digit PINs. Against an attacker limited to 10, 30, or 100 guesses, they found 6-digit PINs provide little to no increase in security over 4-digit ones. iOS's built-in blocklists, 274 four-digit and 2,910 six-digit PINs, helped little too.

The keyspace math misses this. When the guess budget is small, the question isn't how many PINs exist. It's whether yours is among the first few anyone would try.

What to pick for a vault PIN

• Use six digits. If you're picking from scratch, there's no reason not to.
• Make them random. Avoid birthdays, years, repeats, and keypad patterns. Let a dice roll or a password manager generate the digits.
• Don't reuse your phone passcode. One leaked PIN shouldn't open both.
• Turn on Erase Data on your iPhone if it fits your risk. It caps the guess budget at 10.
• Check what your vault app limits. The numbers above describe the iPhone's device passcode. A vault app's own attempt limits and lockouts are app-specific, so don't assume the same protections apply.

A second layer helps too. A decoy PIN opens a different vault, and our piece on passcode versus Face ID covers when each fits.

How Privara handles this

Privara hides your private photos, videos, documents, and contacts behind one AES-256-encrypted vault that looks and works exactly like a calculator. You enter your PIN into the calculator and the vault opens. For exactly the reasons above, we recommend a random 6-digit PIN.

We think it's the best way to keep private content private, for concrete reasons. Your content is encrypted at rest, not just hidden from view. There's no account, and nothing is uploaded by default, so the vault is local and zero-knowledge. A decoy PIN can open a separate vault, Face ID or Touch ID can sit on top of the PIN, and break-in detection captures a photo of anyone who enters the wrong one. All four kinds of content, photos, videos, documents, and contacts, live in that single vault. If you turn on iCloud sync for your device, that changes the threat model, so check what you're syncing.

Download Privara on the App Store and set up your vault with a PIN nobody would guess.