PPasswordForge
Get PasswordForge

PasswordForge · password strength

How strong is an 8-digit PIN?

A 8-digit PIN has exactly 100,000,000 possible values — 26.6 bits. That is small enough to enumerate instantly offline, which is why PINs are only ever safe behind hardware that limits attempts and wipes after a few failures.

These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.

Entropy and keyspace

AlphabetEntropyPossible passwordsVerdict
Digits only (0-9)26.6 bits100,000,000weak

Time to exhaust half the keyspace

Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.

Attack26.6b
Online, rate-limited (10 guesses/sec)58 days
Online, no throttling (1 000/sec)14 hours
Offline, slow hash — bcrypt cost 12 (20 000/sec)42 minutes
Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec)under a second
Offline, well-funded (100 trillion/sec)under a second

Generate one at this strength

The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.

Open PasswordForge

Other strength questions