Revealed: The most and least common four-digit PIN numbers – so, is yours on the list?

With thousands of people falling prey to scams and cyber attacks every year, you might think that people would be a little more careful with their passwords and PINs.

This is evident from an analysis of leaked databases Information is beautiful shows that people still use regular PINs to protect their vital information.

Shockingly, ‘1234’ is still the most common PIN – nearly 11 percent of PINs analyzed.

This is followed by ‘1111’, ‘0000’, ‘1212’ and ‘7777’.

Jake Moore, global cybersecurity advisor at ESET, told MailOnline: ‘Using simple or easy-to-guess passcodes can make it easier for attackers to target people.’

This incredible graph shows the most common PINs from 3.4 million leaked passwords. The PINs are displayed according to their first and last two digits, and the squares become brighter the more they occur

The most common PIN codes

  1. 1234
  2. 1111
  3. 0000
  4. 1212
  5. 7777
  6. 1004
  7. 2000
  8. 4444
  9. 2222
  10. 6969

This data, originally compiled by the late Nick Berrycollects all four-digit PINs revealed by data breaches.

Of the 3.4 million PINs analyzed, the vast majority use simple sequences or repetitive patterns.

Despite being incredibly easy to guess, ‘1234’ is still so popular that it appears more often than all of the 4,200 least common PINs combined.

The second most used password is ‘1111’, which makes up six percent of all PINs in the data.

This is followed by ‘0000’ and ‘1212’, each accounting for almost two percent of all passwords.

When the PINs from this data are plotted based on their first and last two digits, some very interesting patterns emerge.

Most noticeable is a bright diagonal line from bottom left to top right, formed by people using pairs of numbers such as ‘0000’, ‘2323’ or ‘5656’.

If you look at the graph you will also see a clear line that runs horizontally about a quarter of the way up and represents codes starting with ’19’, likely created by people based on their year of birth.

This graph clearly shows a diagonal line of PIN codes with repeating numbers such as ‘1010’. In black and white you also see a faint grid-like pattern that can be caused by people preferring to choose numbers that are close together

The least common PIN codes

  1. 8557
  2. 8438
  3. 9539
  4. 7063
  5. 6827
  6. 0859
  7. 6793
  8. 0738
  9. 6835
  10. 8093

You can clearly see how the line around ‘1960’ becomes a lot brighter as more currently living people are born after this date.

If you make the graph black and white, you will also see a faint “grid pattern” caused by people using numbers that are numerically close together.

This also reveals an L-shaped area in the bottom left corner, which is likely due to people using their birthdays in MMDD or DDMM format.

If you look closely, you will see that the region does not extend beyond 12 or 31, which corresponds to the months of the year and the days in the month.

With 10,000 possible combinations for a four-digit PIN, it should be pretty difficult for anyone to guess your PIN.

However, as Mr. Moore points out, bad cybersecurity habits make it a lot easier for hackers.

Mr Moore said: ‘People continue to use PINs that are commonly used or related and easily accessible, such as dates of birth.

“Partly because our memories have only a limited degree of captivity, but also because they may have been using the same codes for years when cyber consciousness was not so well documented.”

With just 61 guesses, a hacker can crack a third of all passcodes, while with just 426 codes he can guess half of all PIN codes in the dataset.

If you use your birthday or other memorable data as a PIN, experts warn you’re making it significantly easier for criminals (file photo)

Even if the number of attempts is limited, hackers can gain access to 20 percent of people’s accounts in just five attempts.

This makes it very dangerous to use repeating patterns or birthdays as a PIN, as these can easily be guessed if your card or card details fall into the wrong hands.

This same problem applies to passwords for online services such as social media accounts, because people still use common words or strings of numbers.

According to research from NordPass, a password manager, 70 percent of passwords can be cracked in less than a second.

Tomas Smalakys, CTO of NordPass, told MailOnline: ‘To make matters worse, almost a third (31 percent) of the world’s most popular passwords are purely numerical strings.

“Such passwords can be hacked almost immediately because hackers use automated systems rather than typing them out.”

Most common passwords in 2024

  1. 123456
  2. 123456789
  3. administrator
  4. Qwerty
  5. welcome
  6. password
  7. Password1
  8. p@ssw0rd
  9. 12345
  10. Qwerty123

Once your account is compromised, hackers can steal your data directly or use your data to conduct targeted attacks on other people.

“For example, seemingly small details such as your full name or date of birth can be used to carry out more sophisticated and personalized phishing attacks,” says Mr Smalakys.

To stay safe online, cybersecurity experts recommend using longer and more complicated passwords made up of random letters and numbers.

The problem is that these passwords are often as difficult to remember as they are for hackers to guess.

For this reason, it is recommended to use a secure and trusted password manager to store your passwords.

Mr Moore said: ‘People put themselves at risk by using weak passwords and PINs and often don’t fully understand the threat until they are compromised.

‘Password managers provide complete security if such information cannot always be remembered, and they can help generate completely random codes so you don’t have to rely on your birthday or anniversary.’

HOW TO CHECK IF YOUR EMAIL ADDRESS HAS BEEN COMPROMISED

Am I pwned?

Cybersecurity expert and Microsoft regional director Tory Hunt leads ‘Am I pwned’.

The website allows you to check if your email has been compromised as part of any of the data breaches that have occurred.

If your email address appears, you will need to change your password.

Pwned passwords

To check whether your password may have been exposed in a previous data breach, go to the site’s homepage and enter your email address.

The search tool compares this to the details of historical data breaches that have made this information publicly visible.

If your password does appear, you are likely at greater risk of being exposed to hacking attacks, fraud, and other cybercrime.

Mr Hunt built the site to help people check whether or not the password they want to use is on a list of known hacked passwords.

The site does not store your password alongside any personally identifiable information and each password is encrypted

Other safety tips

Hunt offers three easy-to-follow steps for better online security. First, he recommends using a password manager, such as 1Password, to create and store unique passwords for each service you use.

Then enable two-factor authentication. Finally, stay informed of any breaches

Related Post