How many combos for 4 numbers? The short answer: it depends entirely on what you're actually asking.
Most people type this into Google because they're staring at a padlock, a phone screen, or a lottery ticket. But they want a single number. Now, ten thousand. Practically speaking, done. But that's only true if you're talking about a standard 4-digit PIN where every digit can be 0–9 and repetition is allowed. Change one rule — no repeats, order doesn't matter, letters mixed in — and the answer shifts dramatically Worth keeping that in mind..
Let's break it down properly. No fluff. Just the math, the context, and the traps people fall into.
What Is a 4-Number Combination Anyway
Before we count anything, we have to agree on what "combination" means. In practice, in everyday language, it's any grouping of four numbers. But in math, combination has a precise definition: a selection where order doesn't matter. A permutation is a selection where order does matter Not complicated — just consistent..
This distinction isn't academic. Because of that, it's the difference between 210 and 5,040. Or between 10,000 and 5,040.
The four main scenarios
| Scenario | Math term | Formula | Result |
|---|---|---|---|
| Digits 0–9, repeats allowed, order matters | Permutation with repetition | 10⁴ | 10,000 |
| Digits 0–9, no repeats, order matters | Permutation without repetition | 10P4 = 10!/6! | 5,040 |
| Digits 0–9, no repeats, order doesn't matter | Combination | 10C4 = 10!On top of that, /(4! 6!Practically speaking, ) | 210 |
| Digits 1–9 only (no zero), no repeats, order matters | Permutation without repetition | 9P4 = 9! /5! |
See how fast the numbers diverge? That's why "how many combos for 4 numbers" is a trick question Small thing, real impact..
Why It Matters / Why People Care
You're not asking for fun. You're asking because something depends on the answer.
Phone passcodes and ATM PINs
At its core, the most common real-world case. That's why four digits. Day to day, zero through nine. Repeats allowed. Order matters — 1234 is not 4321. That's 10,000 possibilities Not complicated — just consistent. Still holds up..
Sounds like a lot. Still, it's not. A brute-force attack tries all 10,000 in seconds. Also, that's why modern phones lock you out after failed attempts, and why 6-digit PINs became standard. Four digits was never secure against determined attackers — only against casual snooping.
Combination locks (the physical kind)
Here's where language trips people up. A "combination lock" is mathematically a permutation lock. 15-30-5 opens it. Practically speaking, order matters. 30-15-5 doesn't.
But the dial usually has 40 or 60 numbers, not 10. And you're picking 3 numbers, not 4. Still, different problem entirely. If you have a 4-dial lock with 10 digits per dial (0–9), you're back to 10,000. If each dial has fewer options — say 0–5 — it's 6⁴ = 1,296 Turns out it matters..
Most guides skip this. Don't.
Lottery games
Pick 4. Daily 4. Which means cash 4. Different names, same core mechanic: choose 4 digits, 0–9. Some games let you play "straight" (exact order) or "box" (any order). Now, straight = 10,000 combos. Box = way fewer, depending on whether digits repeat Simple as that..
A 4-digit box bet with all unique digits covers 24 permutations. With a pair (like 1123), it's 12. Two pairs (1122) = 6. Three of a kind (1112) = 4. On top of that, all same (1111) = 1. The payout adjusts accordingly.
Passwords and security tokens
If your "4 numbers" are part of a longer password — say, a 4-digit suffix added to a word — the entropy calculation changes. 3 bits of entropy (log₂10,000). Not much either. Four random digits add about 13.Not nothing. A dictionary word plus 4 digits is still crackable in hours on modest hardware Simple as that..
How It Works — The Math Behind the Numbers
Let's derive the main answers so you never have to guess again.
Permutations with repetition (the PIN case)
You have 10 choices for the first digit. Here's the thing — for each of those, 10 choices for the second. Now, third: 10. Fourth: 10.
10 × 10 × 10 × 10 = 10⁴ = 10,000 Easy to understand, harder to ignore..
This assumes 0000 is valid. Some systems exclude it. Some exclude 1234, 0000, 1111, etc. Consider this: — the "common PIN" blocklist. That reduces the effective space, not the mathematical one.
Permutations without repetition
First digit: 10 options. Third: 8. Second: 9 remaining. Fourth: 7.
10 × 9 × 8 × 7 = 5,040.
Formula: nPr = n!/(n-r)! where n=10, r=4.
10! = 3,628,800. Plus, 6! = 720. On the flip side, 3,628,800/720 = 5,040. Checks out.
This applies when a system forces unique digits. Some corporate PIN policies do this. It sounds more secure — and it is, slightly — but it also makes the PIN harder to remember. That's why people write it down. That's a net security loss Took long enough..
Combinations (order doesn't matter)
Now we're choosing 4 numbers from 10, and {1,2,3,4} is the same as {4,3,2,1}.
Formula: nCr = n!/(r!(n-r)!)
10C4 = 10!/(4!6!) = (10×9×8×7)/(4×3×2×1) = 5,040/24 = 210.
Only 210. If a lottery game truly treated order as irrelevant — no straight/box distinction, just "match the 4 numbers in any order" — your odds would be 1 in 210. Because of that, that's tiny. No state lottery works this way. They'd go broke That's the whole idea..
What if the pool isn't 0–9?
Maybe you're picking 4 numbers from 1–50 (like a mini-lottery). Or 1–20. Or a custom set.
General formulas:
- With repetition, order matters: nʳ
- Without repetition, order matters: nPr = n!In practice, - Without repetition, order doesn't matter: nCr = n! That's why /(n-r)! On top of that, /(r! (n-r)!
Plug in your n and r=4. Done Less friction, more output..
Common Mistakes / What Most People Get Wrong
Confusing "combinations" with "permutations
Confusing “combinations” with “permutations” (continued)
The most frequent slip‑up is treating a selection problem as if order mattered when it doesn’t, or vice‑versa. A quick sanity check can save you from orders‑of‑magnitude errors:
| Situation | Does order matter? | Correct formula | Typical mistake |
|---|---|---|---|
| Choosing a locker combination where you must turn the dial left‑right‑left in a specific sequence | Yes | nʳ (with repetition) or nPr (without) | Using nCr and thinking there are only 210 possibilities for a 10‑digit dial |
| Picking numbers for a raffle where any set of four wins, regardless of the order they’re drawn | No | nCr | Using nPr and believing the odds are 1 in 5,040 instead of 1 in 210 |
| Creating a 4‑digit PIN where repeats are allowed and the exact sequence must be entered | Yes (with repetition) | 10⁴ = 10,000 | Assuming 5,040 because you “can’t repeat digits” |
| Designing a password policy that forbids repeated characters in a 4‑character segment | Yes (without repetition) | 10×9×8×7 = 5,040 | Thinking the space is still 10,000 and therefore over‑estimating security |
A useful mnemonic: “Permutations = Position matters; Combinations = Choice only.” If you can swap two items and still have the same outcome, you’re dealing with combinations.
Overlooking the impact of blocklists
Many systems exclude “obvious” PINs (0000, 1234, 1111, etc.). While the mathematical space stays 10,000, the effective guess‑space shrinks. If a blocklist removes 100 common patterns, the attacker’s expected work drops from 10,000/2 = 5,000 guesses (average for a uniform space) to roughly (10,000‑100)/2 = 4,950 – a seemingly tiny change. Still, attackers often prioritize those blocked entries first, so the real‑world reduction can be far larger, especially when users gravitate toward the prohibited patterns despite the policy.
Misapplying the “without repetition” formula to real‑world data
Human‑chosen numbers are far from random. Studies show that digits like 1, 2, 3, and 7 appear disproportionately often in PINs, while 0 and 9 are rarer. Assuming a uniform distribution (as the nPr formula does) therefore overestimates security.
[ H = -\sum_{i=0}^{9} p_i \log_2 p_i \quad\text{bits per digit} ]
For a typical PIN dataset, H ≈ 3.0 bits/digit, giving only about 12 bits for four digits – noticeably less than the 13.3 bits of a truly random 4‑digit string.
Ignoring the difference between “with replacement” and “without replacement” in multi‑stage processes
Consider a scenario where you first pick a digit, then remove it from the pool before picking the next (like drawing balls without replacement). Practically speaking, the space changes after each draw, which is why the product 10 × 9 × 8 × 7 appears. On the flip side, conversely, if you assume dependence when the system actually allows repeats (e. If you mistakenly treat each draw as independent (with replacement), you’ll inflate the count to 10⁴. g., a digital lock that lets you press the same key twice), you’ll underestimate the number of valid codes.
Forgetting to adjust for leading zeros
In some contexts, a “4‑digit number” is interpreted as an integer between 1000 and 9999, implicitly forbidding leading zeros. If your application stores the PIN as a string, leading zeros are usually permitted; if it stores it as an integer, they may be stripped. Day to day, that reduces the count from 10⁴ to 9 × 10³ = 9,000. Always verify the implementation detail before applying the formula.
Counterintuitive, but true Worth keeping that in mind..
Conclusion
Understanding how many distinct four‑digit possibilities exist hinges on three simple questions:
-
Are repetitions allowed?
- Yes → use (n^r) (with replacement).
- No → use (nPr = \frac{n!}{(n-r)!}) (without replacement).
-
Does the order of the digits matter?
- Yes → keep the permutation formulas above.
- No → switch to combinations: (nCr = \frac{n!}{r!(n-r)!}).
-
What is the effective pool size (n)?
- Standard decimal
digits (0–9) vs. a restricted set (e.g., no leading zeros or no specific prohibited sequences).
By moving beyond basic combinatorics and accounting for human psychology, data types, and implementation constraints, we gain a much clearer picture of the true security landscape. While the theoretical maximum for a 4-digit PIN is 10,000, the "effective" search space—the number of attempts an attacker actually needs to succeed—is often significantly smaller. For engineers and security professionals, the goal is not just to calculate the mathematical maximum, but to minimize the actual entropy available to an adversary.
