The four digits were a usability choice
The familiar origin story points to John Shepherd-Barron, one of the early cash-machine developers. He initially considered a six-digit code, the story goes, but his wife found four digits easier to remember. Whether or not that anecdote explains every bank’s decision, it captures the practical tradeoff: a PIN had to be short enough to enter and recall reliably, often at a machine in public.
A PIN—short for personal identification number—is not meant to be a password that stands alone. At a cash machine, the bank also checks the card and limits how many incorrect codes can be tried. Those safeguards make guessing a four-digit PIN much harder than the number of possible combinations alone might suggest.
Short code, layered defenses
A four-digit PIN has 10,000 possible combinations, from 0000 through 9999. That is a small space if someone can test codes freely. But card systems typically block or restrict repeated failed attempts, and a stolen card does not automatically reveal its PIN. The code’s security depends on those controls as well as on secrecy.
The tradeoff becomes clearer when the PIN is used elsewhere. A code entered on a protected bank terminal is different from the same digits reused as a phone passcode or exposed to someone watching. Four digits are convenient, not strong against unlimited guessing. Banks chose a memorable credential and surrounded it with limits on how it could be tested; the weak point is often the surrounding situation, not simply the length of the code.
