What “avoid obvious PINs” removes
For the length you choose, it skips: one digit repeated (000000), straight runs up or down (123456, 987654), a pair repeated (121212), years 1900–2029 for four-digit PINs, and every all-digit entry of that length on the bundled list of 10,001 common passwords. Removing them costs almost nothing: for six digits it removes 199 of 1,000,000 PINs, 0.0003 bits. The count shown is exact, and the generator redraws until it gets a PIN that is not excluded, so the rest stay equally likely.
Why bother, if the loss is that small? Because attackers don't guess in random order. They start with exactly these PINs, so a PIN from the excluded set falls in the first few guesses, which is all a lockout allows.
How long should a PIN be?
| Digits | Bits | Possible PINs | Hit in 10 guesses | Hit in 100 guesses |
|---|---|---|---|---|
| 4 | 13.3 | 10,000 | 0.1% | 1% |
| 5 | 16.6 | 100,000 | 0.01% | 0.1% |
| 6 | 19.9 | 1,000,000 | 0.001% | 0.01% |
| 7 | 23.3 | 10,000,000 | 0.0001% | 0.001% |
| 8 | 26.6 | 100,000,000 | 1e-05% | 0.0001% |
| 9 | 29.9 | 1,000,000,000 | 1e-06% | 1e-05% |
| 10 | 33.2 | 10,000,000,000 | 1e-07% | 1e-06% |
| 11 | 36.5 | 100,000,000,000 | 1e-08% | 1e-07% |
| 12 | 39.9 | 1,000,000,000,000 | 1e-09% | 1e-08% |
A PIN is only as good as the lockout behind it. With ten tries before a lockout, a random 4-digit PIN gives an attacker a 0.1% chance; a random 6-digit PIN, 0.001%. Offline, with no lockout, no PIN length is enough: see how PINs work.