Mobile App Data-at-Rest: PIN-Derived Key vs Offline Brute-Force

Unlock PIN / Passcode

PIN length 6 digits

Character set 10 (digits)

Key Derivation Function

Work factor (cost exponent) 2^14

Attacker Hardware

Live Readouts

Keyspace

1.0e6

Legit unlock latency

—

Attacker guess rate

—

Estimated avg. time to crack

—

How it works

A mobile app that protects local data (an encrypted SQLite/Realm DB, a token vault) commonly derives its AES-256 key from the user's unlock PIN with a key-derivation function, never storing the PIN itself:

key = KDF(pin, salt, work_factor)
N (keyspace)   = charset_size ^ pin_length
cost(W)        = base_cost · 2^(W − 14)
unlock_latency = phone_base_ms(algo) · cost(W)
guess_rate     = hw_throughput(algo) · hw_multiplier / cost(W)
avg_crack_time = (N / 2) / guess_rate

Once a phone is stolen, the attacker has the ciphertext and the salt but not the PIN — this is now a fully offline brute-force with no lockout counter and no network throttling, so the KDF's cost is the only defense.

PIN length / character set — sets the keyspace N. Every extra digit multiplies N by the charset size.
KDF algorithm — PBKDF2 is cheap to run in parallel on GPUs/ASICs because it needs almost no memory; scrypt and Argon2id force each guess to touch a large memory buffer, which is expensive to replicate thousands of times in parallel silicon, so their hw_throughput baseline is orders of magnitude lower for the same attacker hardware.
Work factor — raising it multiplies the cost of every hash, defender's and attacker's alike, by the same 2× steps. It is the only knob a developer controls directly, and it is a straight trade: higher W slows the attacker but also slows the legitimate unlock on-screen.
Attacker hardware — a bigger cluster raises guesses/sec linearly, but a memory-hard KDF caps how much that scaling actually helps, because memory bandwidth (not compute) becomes the bottleneck.

The "Run Attack Demo" button plays a time-compressed animation so an attack that would really take years is visible in seconds — the real estimated crack time is always shown as a number above, not the animation's speed.

Brute-force guess Encrypted vault

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.