AI cracks your 4-digit PIN in less than a second – so why are we still using them?

If you use a PIN made of repeated digits, classic patterns like “1234”, or your birthday date – be cautious. Attackers might get access to your data in less than a second.

A 4-digit PIN code is so familiar that it's basically muscle memory at this point. It has been guarding bank accounts, phones, and private data for decades.

But in the age of artificial intelligence (AI), trusting your data to be protected by PIN might be as naive as scribbling your passwords on sticky notes. The combination of simple digit patterns in your PIN code creates an easy target for AI hacking tools.

Recent research by Mesente, a business messaging platform, shows that AI can now crack weak PINs in less than a second. That’s faster than most of us can even unlock our phones.

According to the research, PINs with repeated digits are the easiest for AI to crack, taking just 0.44 seconds on average.

How does AI outsmart humans by searching for patterns?

The team analyzed real-world breach datasets and trained a supervised machine learning model. The model was designed to learn patterns in PIN selection behavior and predict the most probable PIN codes.

Researchers broke PINs into categories and scored them by how easy they were to crack:

• Same Digits: Digits that repeat four times, like “1111” or “0000.”
• Consecutive: Numbers that increase or decrease sequentially, like “1234” or “4321.”
• Grouped: Digits that repeat in pairs or patterns, such as “1122” or “5566.”
• Year-like: PINs that resemble years, especially from the 1900s or 2000s.
• Random: PINs that don’t follow any obvious pattern.

The top 10 most easily-cracked PIN codes all share the same feature: repeated digits. AI can crack PINs made up of the same digit in just 0.37 seconds. Not far behind are consecutive sequences like “1234” or “4321”, which fold in 0.69 seconds.

The hardest PINs for AI to crack are random ones that do not follow any pattern. But even those hold out for only about 1.03 seconds.

“The fact that AI can crack commonly used PINs should be a major wake-up call for both individuals and businesses. For businesses using SMS or PIN-based verification flows, weak PIN codes can leave customer accounts vulnerable, even when two-factor authentication is enabled,” said Uku Tomikas, CEO of Messente.

To stay safe, it is recommended to implement multi-layered authentication, such as randomized one-time passwords (OTPs), time-based tokens, and PIN fallback mechanisms to reduce the impact of predictable codes.

Why do we still use 4-digit PINs?

The international standard for PIN management in financial services – ISO 9564 – technically allows for PINs anywhere from four to twelve digits long. But in practice, most banks still stick to four digits. Mainly because the human mind loves patterns and is weak in remembering things.

Research shows we can hold about 7 ± 2 chunks of info in short-term memory, so a four-digit code fits comfortably in our mental bandwidth. Push it to 6, 8, or 12 digits, and suddenly people start writing PINs down on sticky notes or using their birth year twice.

Also, 4-digit PINs are standard for legacy systems that are designed to accommodate them. The four-digit PIN has 10,000 possible combinations, which sounds decent until you realize AI can burn through that in less than a second.

However, it doesn’t mean PINs are as unsafe as a 4-digit “password” on a website. PIN codes are tied to physical cards and protected by brute-force limits.