PIN vs Password: What's the Difference, and When Does Each Belong?

A PIN and a password solve similar problems with very different amounts of raw entropy. Understanding why a 4-digit PIN can be perfectly reasonable in one context and dangerously weak in another comes down to where the guessing happens.

The entropy gap

A 4-digit PIN has 10,000 possible combinations — about 13.3 bits of entropy. A 12-character password using the full character set has closer to 79 bits. That's not a small difference; it's the gap between something a computer could exhaust in a fraction of a second and something that would take longer than a human lifetime with realistic hardware.

Why PINs are still safe on your phone

A device PIN isn't being attacked the way an online account is. After a handful of wrong attempts, phones enforce escalating delays, and eventually a full wipe. The attacker also needs physical possession of the device. That combination of rate-limiting and physical access requirement is what makes a short PIN acceptable in that specific context — the low entropy is compensated for by the attack being slow and constrained by design.

Why a PIN fails as an online account password

Online, none of those protections can be assumed. If a service doesn't rate-limit login attempts properly, or if an attacker has an offline copy of a breached password database, a 4-digit PIN's 10,000 combinations can be exhausted almost instantly. This is exactly why banking apps use a PIN for the app itself on your own device, but never as the password protecting your actual online banking account.

The rule that resolves the confusion

Match the credential to where the guessing happens:

• Local, rate-limited, physical-access-required (unlocking your phone or laptop): a PIN or biometric is fine.
• Anything reachable over the internet (any online account): use a long, generated password, plus two-factor authentication.

The mistake to avoid is treating the two as interchangeable just because both are "short codes you type in." The security model behind them is completely different.