Whenever we need to choose a four-digit combination for a luggage lock, a key safe, or a hotel safe, most of us try to come up with something that would be as difficult to crack as possible.
We approach this seemingly trivial task in surprisingly different ways. Some of us try to make the combination look as random as possible, avoiding obvious patterns or sequences: 2971, say, rather than 9876, 2864, or even 4981. Others deliberately choose a number beginning with 8 or 9, reasoning that a would-be thief might try combinations sequentially, starting at 0000 and working their way towards 9999. Why not put our secret somewhere near the far end of that journey?
And then there are those who don’t bother with any of this and simply choose a number they can remember, whether it’s small, round, peculiar, or entirely unremarkable.
But does it really matter? Is there any point in taking the choice so seriously? Is 9876 inherently more secure than 6789?
From a purely mathematical perspective, the answer is no. If four-digit combinations were chosen completely at random, every possible number would have exactly the same probability of being selected. Whether it’s 0000, 1234, 2971, 3355, or 9998, the probability would be one in 10,000, or 0.01%.
There’s a small problem with this reasoning, however: people aren’t particularly good at being random.
Both parties involved in our little security contest – the person choosing the combination and the person trying to guess it – are human beings. The former tries to invent something that would be difficult to predict, while the latter attempts to predict exactly what the former might have invented.
And human beings have preferences. We like patterns, repetitions, familiar dates, and memorable sequences. A person choosing a PIN may favour 1111 or 1234 simply because these are easy to remember. An attacker, knowing this, would be wise to try such combinations first rather than blindly working through all 10,000 possibilities.
In other words, while all four-digit numbers are mathematically equal, they are not equally popular. And this makes some combinations much easier to guess than others.
Of course, if the attacker has unlimited time and the lock doesn’t impose any restrictions on failed attempts, even an unusual four-digit combination isn’t particularly formidable. There are only 10,000 possibilities, after all.
I once had the dubious pleasure of testing this principle myself after forgetting the combination to my own key safe. It took me about forty minutes of trying different numbers before the little thing finally surrendered. Unfortunately, it happened on a chilly December evening, and I couldn’t feel my fingers for another two hours.
But I digress.
Back in 2012, the people at DataGenetics decided to investigate the matter scientifically. They analysed a collection of 3.4 million leaked four-digit passwords and ranked the combinations by popularity.
The results were hardly surprising at the top of the list. Predictable combinations such as 1234, 1111, and 1122 were among the favourites.
But what about the other end of the table? What about the combinations that practically nobody wanted?
The winner – or rather, the loser – was 8068.
Out of 3.4 million entries, this humble number appeared just 25 times. The closest runners-up in the contest for obscurity were 8093 and 9629.
There was another curious detail. Of the twenty least popular combinations, eleven began with 8 or 9, while only three began with a digit smaller than 6. This hardly supports the theory that people commonly choose higher numbers to make sequential brute-force attacks more laborious.
But let’s return to our champion.
What makes 8068 so special?
Well, absolutely nothing.
And that, I think, is precisely what makes it interesting.
There is nothing particularly appealing about 8068. No obvious sequence, no satisfying mathematical relationship, no memorable association that immediately springs to mind. It doesn’t look clever, elegant, or amusing. It’s just four digits sitting together, minding their own business.
It’s a number so thoroughly unremarkable that our minds have little reason to settle on it.
In a peculiar way, 8068 might be one of the most random-looking numbers from a human perspective. Not because it’s mathematically any more random than its neighbours, but because it lacks the qualities that usually tempt us to choose one number over another.
It’s the forgettable face in a crowd: perfectly ordinary, practically invisible, and all the more remarkable for it.
And here’s where things get particularly amusing.
By identifying 8068 as the least popular four-digit PIN, we’ve inadvertently given it the very quality it was missing.
We’ve made it special.
Once a number becomes famous for being obscure, it is no longer quite so obscure. People who would never have considered 8068 before might now choose it precisely because of its reputation. Its extraordinary dullness becomes an attraction. And the more people learn about it, the more likely it is to lose the distinction that made it famous in the first place.
In other words, by celebrating its glorious anonymity, we have begun to destroy it.
There’s something rather beautiful about that paradox. A number becomes interesting because nobody finds it interesting, and the moment we acknowledge this, the whole thing starts to unravel.
So, the next time you’re setting the combination on your luggage lock, by all means choose something unusual.
Just perhaps not 8068.
We’ve already ruined that one.
If you’re curious about the other mathematical, statistical, and psychological oddities of four-digit PINs, I wholeheartedly recommend the original DataGenetics article. Among its more startling findings is that just 61 guesses would be enough to cover roughly a third of the passwords in their dataset. So much for our ingenuity!