A PIN that's four digits long protects your bank card; a four-digit password protecting your email would be gone in under a second. Same string, wildly different safety - And the difference has nothing to do with the characters themselves. Passwords, PINs, and passphrases are often presented as a weakness ladder, as if a PIN were just a lazy password and a passphrase a deluxe one. In reality they're three tools designed for three different attack scenarios, and each is the correct choice in its native habitat. Sorting out which is which explains several things that otherwise seem absurd - Including why your phone is comfortable defending your entire digital life with six digits.
Three tools, three threat models
A password authenticates you to a remote service. Its defining burden is that a copy of it (hashed, hopefully) sits in a database you don't control - And when that database leaks, attackers guess against it offline, on their own hardware, at billions of attempts per second, forever. A password must therefore carry enough entropy to survive unlimited guessing.
A PIN authenticates you to a thing you're holding - A phone, a bank card, a hardware key. The secret typically never leaves the device; verification happens inside a chip that enforces the rules. Its defining protection is that the hardware counts failures: wrong guesses trigger delays, lockouts, or a full wipe. The entropy can be tiny because the guess budget is tinier.
A passphrase is a password built from randomly chosen words rather than random characters. Same job as a password, same threat model - But packaged so a human brain can actually store it. It exists because the passwords that must live in your memory (master password, device login) still need offline-attack-grade entropy, and kX9$vw!2Lq@8 doesn't stick.
The numbers behind each
Entropy - How many possibilities an attacker must search - Is the common yardstick. The gap between the three is enormous:
A 6-digit PIN's million possibilities would take a GPU a blink to exhaust - if it got unlimited tries. It doesn't. An iPhone escalates delays after failed attempts and can erase itself at ten; the secret is additionally entangled with a hardware chip so the guessing can't be moved offline to faster machinery. The device turns 20 bits into a genuinely hard target. The full bits-to-crack-time story is in password entropy explained.
That logic collapses the instant a PIN-sized secret leaves its hardware bodyguard. Use 847293 as a website password and it faces the offline scenario naked - Dead in milliseconds. Conversely, demanding a 105-bit password to unlock a phone with a rate-limited chip would be all pain, no gain.
A PIN is only as strong as the hardware that counts the failures. Take away the counter and a PIN isn't a small password - It's no password at all.
Side by side
| PIN | Password | Passphrase | |
|---|---|---|---|
| Typical form | 4–8 digits | 12–20+ mixed characters | 5–8 random words |
| Entropy | ~13–27 bits | ~78–130 bits (if random) | ~65–103 bits |
| Verified by | Local hardware/chip | Remote server | Remote server or local vault |
| Survives offline attack | No - Relies on guess limits | Yes, if random and long | Yes, if words are random |
| Memorability | Trivial | Poor | Good |
| Native habitat | Devices, cards, hardware keys | Online accounts (via a manager) | Master passwords, device logins |
Where each belongs
PINs: devices and hardware. Phone unlock, bank cards, hardware security keys, Windows Hello. Note the clever design of Windows Hello: the PIN unlocks this machine's hardware-bound credential rather than your Microsoft account password, so it's useless if stolen and phished nowhere. Two upgrades cost little: move from four digits to six (or eight), and make them random - Birthdays, years, and patterns like 2580 (a straight line down the keypad) dominate real PIN datasets, and a thief who knows your birthday gets a free shot. A PIN generator removes the human predictability in one click.
Passwords: every online account. Here the offline-leak scenario rules, so entropy is non-negotiable - 16-plus random characters, unique per site, produced by a password generator and stored in a manager. The reasoning behind that floor, with crack-time tables, is in how long should a password be. Uniqueness matters as much as strength: a leaked password gets replayed against every major service within hours.
Passphrases: the passwords your brain must hold. Master password, laptop login, disk encryption. Six-plus words, chosen by a passphrase generator or physical dice - Never composed by you, since human-picked "random" words cluster hard around common vocabulary and grammatical order. The technique and its Diceware history are covered in what is a passphrase.
Common mismatches to fix
- PIN-grade secrets on websites. A digits-only or 6-character password on a web account imports the weak credential without the hardware that made it safe. Fix first - These fall to the crudest attacks.
- Human-invented master passwords. The one credential that most needs passphrase treatment usually gets
Name+Year!instead. It faces offline attack if your encrypted vault is ever stolen; give it real dice-driven words. - The same PIN everywhere. Phone, bank card, garage, SIM - One shoulder-surf or skimmed keypad shouldn't open your whole physical life. PINs are short; you can afford several.
- Written-down passphrases defeating their purpose. A passphrase's virtue is memorability. If yours needs a sticky note after two weeks, it's the wrong passphrase - Regenerate and pick the candidate that sticks.
- Treating any of the three as sufficient alone. All are single factors. Anything important deserves a second one - The two-factor authentication guide covers adding it in minutes.
FAQ
Why is a 6-digit phone PIN safe when a 6-character password isn't?
Because the phone's secure hardware enforces a guess budget - Escalating delays, then lockout or wipe - And binds decryption to the physical chip so attackers can't extract the puzzle and guess offline. A website password must assume the opposite: unlimited offline guesses against a leaked database. Same string, different referee.
Is a passphrase always better than a password?
No - They're tuned for different constraints. Where software remembers the credential, a 16–20 character random password packs more entropy into fewer keystrokes. Where your memory is the storage medium, the passphrase wins decisively. The mistake is using human-invented hybrids that are neither random nor memorable.
Should my PIN be truly random, or is avoiding my birthday enough?
Go fully random. Analyses of leaked PIN datasets show massive clustering: dates, repeats (1111), sequences (1234), and keypad patterns cover a huge share of real PINs, so an attacker's first dozen guesses are far better than chance. A random PIN pushes them back to brute luck against a device that only allows a handful of tries.
What about pattern unlock and biometrics - Where do they fit?
Pattern unlock is a low-entropy PIN variant with an extra weakness: smudge trails and shoulder-surfable shapes, with popular patterns as predictable as popular PINs. Biometrics are convenience layers on top of a PIN or passphrase, not replacements - Your fingerprint unlocks a key that the PIN still guards after reboots and failed reads. The underlying PIN remains the floor of your device security.
Can I use a passphrase as my WiFi password?
It's the ideal choice: WPA2 handshakes can be captured and attacked offline, so real entropy matters, yet the credential must also be read aloud to guests and typed on TV remotes. Four to six random words handle both jobs gracefully - Far better than either family2020 or an unspeakable 24-character string.