# Why does a personal identification number (PIN) code only contain 4 digits?

I'm in the process of designing an app that allows users to sign in via a personal identification number (PIN) code. I'm curious to know why a typical pin code usually contains four numbers, and why this is common practice?

• I see you have an answer, but I suspect you weren't asking about Postal Index Numbers. Am I correct in reading your question as referring to a Personal Identification Number on used on mobile phones? Either way, please clarify your question. – Monomeeth May 20 '16 at 11:49
• Yes, I was referring to a Personal Identification Number. The type you might find on a mobile app for a financial institution, or what you would enter into an ATM before withdrawing cash. – user47821 May 22 '16 at 22:56

Quite an user experience question, where technology development had to adapt to real life experience, in this case the inventor's wife experience

The standard, ISO 9564-1, allows for PINs from four up to twelve digits. The inventor of the ATM, John Shepherd-Barron, had at first envisioned a six-digit numeric code, but his wife could only remember four digits, and that has became the most commonly used length in many places, although banks in Switzerland and many other countries require a six-digit PIN .

While the UX aspect of the question is important, there is a security question hidden within: how can a 4 digit PIN be secure enough to protect my money?

The answer is that a PIN must be tested while it's connected to a secure system, and the secure system needs to limit how many times it can be tested and then disable it.

If the PIN is not being checked by a secure system, there is no security. You could simply type every number from 0000-9999 in just a few hours (or a computer can try them all in a few microseconds.) Eventually, you'll gain access.

If the PIN is being checked by a secure system, the secure system can give the user three tries and then lock the account from PIN access. This means the chances of guessing the right PIN are fairly low, which is the risk the system owners take (assuming the user doesn't choose '1234', or their birthday, of course.)

There are many variations on this theme, of course, and many vulnerabilities and weaknesses associated with various implementations of it. But the primary security feature is that a limited number of guesses are allowed and then access is denied.

If you think wider around the world - the digits vary. In India we have 6 digit pincode, in US some states have 5 digits and other may have different.

ZIP codes were only first introduced in the 1960s with the introduction of new automated address reading machines. With rapid post-war growth across the country and the increasing volume of mail (which doubled between 1942 and 1962 from 33 billion to 66 billion pieces annually

https://www.policymap.com/blog/2013/04/tips-on-zips-part-ii-a-brief-history-us-postal-codes/