PPasswordForge
Get PasswordForge

PasswordForge · password strength

How strong is a 6-digit PIN?

A 6-digit PIN has exactly 1,000,000 possible values — 19.9 bits. That is small enough to enumerate instantly offline, which is why PINs are only ever safe behind hardware that limits attempts and wipes after a few failures.

These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.

Entropy and keyspace

AlphabetEntropyPossible passwordsVerdict
Digits only (0-9)19.9 bits1,000,000weak

Time to exhaust half the keyspace

Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.

Attack19.9b
Online, rate-limited (10 guesses/sec)14 hours
Online, no throttling (1 000/sec)8.3 minutes
Offline, slow hash — bcrypt cost 12 (20 000/sec)25 seconds
Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec)under a second
Offline, well-funded (100 trillion/sec)under a second

Generate one at this strength

The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.

Open PasswordForge

Other strength questions