Why Your Bank PIN Is 6 Digits But Wi-Fi Needs 8: The Offline Cracking Difference

Bank cards and Wi-Fi networks both rely on passwords, but their threat models are fundamentally different. A bank card PIN is only six digits (1 million combinations), yet it remains secure because the ATM allows just three guesses before swallowing the card and freezing the account — a probability of roughly 1 in 330,000. This online authentication model, pioneered by ATM inventor John Shepherd‑Barron in 1967 (originally a 4‑digit PIN), puts the defender in control of attempt rates.

Wi‑Fi using WPA2‑Personal (WPA2‑PSK) operates differently. Every connection performs a four‑way handshake where the access point and client exchange nonces ( ANonce, SNonce) and derive a session key, attaching a Message Integrity Code (MIC). An attacker in monitor mode can capture these EAPOL frames (a few KB) and then run an offline dictionary attack without any interaction with the router. Guessing wrong a million times leaves the router unaffected.

Modern hardware makes this terrifyingly fast. A consumer RTX 4090 GPU can test about 2.6 million WPA2 hashes per second . An 8‑digit numeric password (100 million combinations) falls in ~38 seconds; a birthday‑based password (tens of thousands of combos) cracks in 0.01 seconds. Worse, the SSID is used as the salt for key derivation, so pre‑computed dictionaries for common SSIDs like TP-LINK or ChinaNet eliminate the need for real‑time hashing entirely.

“密码长度需为 8 到 63 位。”

Security expert Robert Moskowitz (co‑author of the private‑address RFC) warned in 2003 that human‑chosen 8‑character passwords are almost always in dictionaries; he argued a minimum of 20 characters was needed to resist offline attacks. The standards committee kept the floor at 8 characters for usability, with the 63‑character ceiling imposed only by a technical quirk (64 characters would be interpreted as a raw hex key).

The situation improved in 2018 with WPA3 , which replaces the PSK handshake with Simultaneous Authentication of Equals (SAE). Each guess now requires a live exchange with the router, restoring the online rate‑limiting model that bank cards have used for decades. However, many networks still run WPA2 for compatibility.

Practical advice: enable WPA3 if your hardware supports it; otherwise, avoid pure numbers or birthdays and use a long, unique passphrase (e.g., a dialect sentence or pinyin phrase). Change the default SSID to defeat pre‑computed dictionaries.

Bottom line: Bank cards dare to use 6 digits because they allow only three tries. Wi‑Fi demands 8+ characters because it cannot limit how many times an attacker guesses offline. Moskowitz warned 20+ characters are truly needed; WPA3 finally brings the defender back in control.