Your password sucks. But does your PIN code suck too?

Password health is important, but don’t overlook the humble PIN, too. Often just four digits, it stands between bad actors and major parts of your life: your bank account, your smartphone, your home security system.

But most people chose weak, easily guessed PINs for protection. And chances are, you’re one of them.

Earlier this week, the Australian Broadcasting Corporation (ABC) revealed common usage trends in 29 million hacked or leaked PINs, found in the data hosted by security site HaveIBeenPwned. Turns out, almost one in 10 people rely on the same four-digit code—and it’s stupidly easy to guess.

(Yep: It’s 1234.)

In fact, that’s true of every popular code in the list. If you’ve ever had the impulse to sweep your fingers across a row of keys to create your PIN, so has someone else. Same applies to picking a sequential set of numbers, using the same numeral for all four digits, repeating two numerals, or choosing a birth year.

Erol Ahmed / Unsplash

You can see the top 50 discovered by the ABC in their article, which includes a very slick visual presentation of the data. (It makes parsing so many numbers interesting and easy to follow—very worth checking out.) For a sampler, here are the 20 most common codes:

1. 1234 (9.0%)
2. 1111 (1.6%)
3. 0000 (1.1%)
4. 1342 (0.6%)
5. 1212 (0.4%)
6. 2222 (0.3%)
7. 4444 (0.3%)
8. 1122 (0.3%)
9. 1986 (0.3%)
10. 2020 (0.3%)
11. 7777 (0.3%)
12. 5555 (0.3%)
13. 1989 (0.3%)
14. 9999 (0.2%)
15. 6969 (0.2%)
16. 2004 (0.2%)
17. 1010 (0.2%)
18. 4321 (0.2%)
19. 6666 (0.2%)
20. 1984 (0.2%)

(As a reminder, 0.2 percent of 29 million is 580,000, so it’s still well over half a million people sharing 1984 as a PIN.)

With up to 10,000 permutations possible for a four-digit PIN, having almost 10 percent of people rely on the same super guessable one is an unnecessary security hazard. It’s just as bad when you look at six-digit PINs (123456).

If you have a weak PIN, the fix is simple. You can use a password generator for a truly random PIN, and then update accordingly. This task is simple if you use a password manager. (If you don’t, we have recommendations you can look at.)

No password manager? I’d advise you consider one, but you can at least upgrade your PIN security by choosing a string of digits that seem random, but have personal meaning for you. For example: The day you met each of your enemies. Scale the number of enemies appropriately for the length of your PIN. (Obviously, this only works if no one knows who you consider an enemy.)