How Long Would It Take to Crack a 4-Digit Keypad Lock? The Real Math
A 4-digit keypad code has exactly 104 = 10,000 possible combinations. That number alone doesn't tell you much — what matters is how fast an attacker can try them, and whether the keypad does anything to slow that down. Run any of this yourself in the Keypad Combination Calculator; here are the numbers worked through across code length, keypad size, and lockout policy.
No lockout: the code is weaker than it sounds
| Attacker speed | Average time to find the code | Worst case |
|---|---|---|
| 1 guess/second (patient, manual) | 1.4 hours | 2.8 hours |
| 100 guesses/second (basic automation) | 50 seconds | 1.7 minutes |
A keypad with no lockout doesn't need a sophisticated attacker — a $20 microcontroller trying codes at 100 a second finds the average 4-digit code in under a minute. That's the entire vulnerability in one line: a 4-digit code isn't the weak point, the missing lockout is.
Does code length alone save you? Not by much, without a lockout
| Code length | Possible codes | Average time, no lockout, 1/sec | Worst case |
|---|---|---|---|
| 4 digits | 10,000 | 1.4 hours | 2.8 hours |
| 5 digits | 100,000 | 13.9 hours | 1.2 days |
| 8 digits | 100,000,000 | 1.6 years | 3.2 years |
Length does eventually matter a great deal — 8 digits without a lockout is genuinely strong even against a patient manual attacker. But most residential keypads only support 4–6 digits, and most people won't remember or reliably enter an 8-digit code anyway, which is exactly why the lockout setting matters more in practice than code length alone.
Add a lockout, and the math flips
A lockout — say, 5 wrong tries triggers a 5-minute wait — doesn't make the attacker's per-guess speed any slower. It makes the total number of guesses they can attempt per hour collapse.
| Code | Lockout policy | Average time to crack | Worst case |
|---|---|---|---|
| 4 digits (10,000 codes) | No lockout, 1/sec | 1.4 hours | 2.8 hours |
| 4 digits (10,000 codes) | 3 tries / 1 min wait | 1.2 days | 2.4 days |
| 4 digits (10,000 codes) | 5 tries / 5 min wait | 3.5 days | 7.1 days |
| 4 digits (10,000 codes) | 5 tries / 15 min wait | 10.5 days | 20.9 days |
| 6 digits (1,000,000 codes) | 5 tries / 5 min wait | 353 days | 1.9 years |
Notice what happened: the 4-digit code went from "under a minute" (no lockout, automated attacker) to "3.5 days on average" purely from adding a wait timer — the attacker's guess rate never changed. The lockout is doing essentially all of the work, and a longer wait window (15 minutes vs. 5) buys more time for roughly the same inconvenience to a legitimate user who occasionally mistypes.
Does a bigger keypad (with */# keys) help?
A 12-key keypad (10 digits plus * and #) used for a 4-character code with repeats allowed gives 124 = 20,736 possible combinations — roughly double the 10-key, 4-digit space, taking the no-lockout average from 1.4 hours to 2.9 hours. It's a real improvement, but a smaller one than simply adding a fifth digit (13.9-hour average) or enabling a lockout (3.5-day average). If your keypad allows symbol characters in the code, use them, but don't treat it as a substitute for a lockout.
Does banning repeated digits help? No — it makes the code weaker
A common (and backwards) assumption is that requiring no repeated digits in a code makes it stronger. The opposite is true: allowing repeats gives 104 = 10,000 possible 4-digit codes, while banning repeats restricts the count to the permutation P(10,4) = 10×9×8×7 = 5,040 — roughly half the search space, cutting the average no-lockout crack time from 1.4 hours to 42 minutes. If your keypad or PIN policy offers a "no repeated digits" option, leave it off; it exists as a memorability nudge, not a security feature.
What this means for your actual keypad
- If your keypad has no lockout setting, that's the first thing to fix — it matters more than code length. Check the manual; many keypads support this but ship with it disabled.
- Once a lockout is enabled, going to 6 digits is a genuinely large upgrade — from days to nearly a year of average brute-force time, for one extra digit to remember.
- A longer lockout wait (15 minutes vs. 5) is a free upgrade if your keypad supports configuring it — it roughly triples the crack time for the same false-alarm cost to a legitimate user who mistypes occasionally.
- Rotate codes given to contractors, cleaners, or short-term guests rather than leaving one code active indefinitely — a shared code that leaks removes the brute-force question entirely, since none of this math matters if the attacker was simply handed the code.
When this math doesn't apply
All of the above assumes an attacker with no other information trying codes essentially at random. It doesn't model a shoulder-surfed code (someone watched you enter it), a code shared beyond its intended recipient, or a keypad with visibly worn keys that narrows the guessable digits — all of which bypass the brute-force math entirely and are, in practice, more common real-world failure modes than a script grinding through the full keyspace. Physical discretion when entering a code and periodic rotation matter as much as the numbers above.
The worn-key giveaway, explained
A physical keypad used for years develops visibly worn keys corresponding to the digits used in the code — a real, well-documented weakness distinct from the brute-force math entirely. If a code uses digits 2, 5, 7, and 9, those four keys show more wear than the other six, and an attacker who notices this has effectively reduced a 4-digit, 10-key problem to guessing the order of 4 known digits — just P(4,4) = 24 possibilities if repeats aren't used, trivial regardless of lockout settings. Wiping down or periodically rotating a physical keypad's most-used keys, or choosing a keypad with backlit or capacitive-touch keys that don't show physical wear the same way, closes this specific gap.
FAQ
What's the single best change I can make to my keypad's security?
Enable the lockout feature if it isn't already on — it has the largest single impact of anything on this page, larger than code length.
Is a 4-digit code ever acceptable?
Yes, with a lockout enabled — 3.5 days average brute-force time is a reasonable bar for a residential door where the attacker also risks being seen standing at your keypad for that long.
Do commercial keypads use the same math?
Identically — the combinatorics don't change based on the building type. See keypad, fob, or badge for a small business for the business-specific context.
Does this apply to a smart lock's keypad too?
Yes — a smart lock's PIN entry has the identical brute-force math as a standalone keypad. See the smart lock buying guide for how this fits into a broader buying decision.
Do all keypads let you configure a lockout, or is it a fixed factory setting?
It varies by model — most mid-range and higher keypads expose lockout settings in their configuration menu or app, but some budget units ship with a fixed, non-configurable policy (or none at all). Checking this specifically before buying is worth doing given how much it affects real-world security.
This math applies identically whether the keypad guards a standalone door lock, a smart lock's PIN entry, or a business's back-door keypad.