On this page
When you set up a new combination lock for your gym locker, a travel suitcase, or a bicycle chain, you face a quick mathematical decision. By choosing a 4-digit PIN, you are selecting one specific code out of thousands of possibilities. But exactly how secure is that choice against someone trying to guess it?
Understanding how to calculate these combinations is a classic exercise in probability and counting. It also reveals why certain passcodes are much weaker than the maths originally suggests. The calculation depends on whether the numbers can be reused.
How many codes for 4 digit lock with repeats?
A standard combination lock has four spinning dials. Each dial has ten digits, running from 0 through 9.
When you are allowed to repeat digits—meaning a code like 2222 or 1001 is perfectly fine—you use the fundamental principle of counting. You multiply the number of choices for each position together.
For the first dial, you have 10 choices. For the second dial, you still have 10 choices, regardless of what you picked first. The third and fourth dials also offer 10 choices each.
Therefore, a 4-digit lock with repeats allows 10 × 10 × 10 × 10 = 10,000 possible codes. The combinations range from 0000 all the way to 9999 (Math is Fun).
If you are studying for exams and need to remember the rule for similar problems, counting arranging letters with repeats uses the exact same multiplication principles to count possibilities.
What if the lock does not allow repeats?
Some digital systems and mechanical push-button locks do not let you use the same number twice. If you press a 3, you cannot press 3 again.
Without repeats, the number of choices drops sequentially as you move through the sequence. You have 10 choices for the first digit. Because you cannot reuse that digit, you only have 9 choices for the second digit. The third position gives you 8 choices, and the final position leaves you with 7 choices.
The total number of codes without repeats is 10 × 9 × 8 × 7 = 5,040 codes (Math is Fun).
By removing the ability to repeat digits, the lock loses nearly half of its possible combinations. You can see similar restrictions in probability when drawing items with and without replacement.
If you struggle to picture how changing the rules changes the number of outcomes, the Fermi Simulation Lab provides interactive simulations for the ideas that are easier to see than to read.
How long does a brute-force attack take?
If an attacker does not know the code, their most basic method is a "brute-force" attack: trying every single combination starting sequentially from 0000 (DataGenetics).
Testing all 10,000 combinations by hand is a slow process that requires thousands of turns. Even if the lock does not allow repeats, the 5,040 combinations still present a significant physical barrier. While automated digital systems can test combinations instantly unless they have security lockouts, a mechanical padlock relies entirely on the physical time it takes to spin the dials.
Why are human-chosen PINs weaker?
While 10,000 possible codes might sound like a solid defence, human psychology drastically reduces that security. A landmark DataGenetics study analysed 3.4 million leaked 4-digit passwords and found that people are highly predictable in their choices.
According to the data, almost 11% of people use the exact same code: 1234 (DataGenetics).
The study also revealed that the top 20 most common PINs—including obvious patterns like 1111, 0000 and 1212—make up nearly 27% of all codes in use. An attacker who tries just those 20 common codes has better than a one in four chance of opening the lock, completely bypassing the need to test thousands of combinations.
How can you choose a stronger PIN?
Because the time to crack a combination lock drops significantly when attackers try common patterns first, your goal is to choose a code that falls far outside the top 20 most popular PINs. Here is a simple checklist for setting a secure 4-digit code, based on the DataGenetics findings:
Avoid years: The analysis showed a massive spike in PINs starting with "19" (such as 1985 or 1999) because people use their birth years. If you must use a year, pick one from historical events that have no connection to you.
Avoid keyboard patterns: Running your finger down the middle of a keypad gives you 2580, which is the 22nd most common PIN. Avoid straight lines, corners or simple geometric shapes on digital keypads.
Avoid repeating pairs: Codes like 4545 or 8989 are easy to remember but are among the first combinations an attacker will try.
Use a memorisation word: Pick a four-letter word that you can picture in your mind, such as "BIRD" or "LION", and use a phone keypad to translate it into digits (for example, BIRD becomes 2473).
By choosing a truly random code, you force anyone trying to open your lock to rely on the slow brute-force method, ensuring your belongings stay completely secure.
