Video narration
Here is the catch: four digits do not automatically mean four-digit security. If you choose a birthday, 1234, 0000, or repeated digits, an attacker tries those likely choices first. Your PIN still appears to have 10,000 possibilities, but your habits have made a small part of that space much more likely. A random PIN uses the space more evenly. That is the turn: a code is not secure because it looks secret. It is secure when the number of likely guesses is large and the system makes attempts difficult. That is why real systems add a rate limit, lockouts, and sometimes delays between guesses. They may also avoid storing the original code, checking it against a one-way representation instead. That protects the stored secret, but it cannot rescue a weak, predictable PIN from guessing. So what is the math behind a security code? Count the choices: with k choices at each of L positions, there are k^L possibilities. Then make every guess unlikely, slow, or limited. For your phone PIN, security is not secrecy alone; it is the distance between one guess and the full set of guesses.