10,000 — but most PINs aren't random, which makes them far easier to guess
The math gives every PIN an even 1-in-10,000 chance, but real people don't choose evenly. A handful of patterns — 1234, 0000, birth years, repeated digits — show up far more often than chance would predict. An attacker who tries the most common PINs first does much better than the 10,000 figure suggests.
