Ground truth · prediction under oath

The count that was never counted

This page will make three predictions about you. Each is sealed before you can act. Two will be revealed and then refused a score. Only one has an obtainable population, a stated extraction rule, and a baseline that can lose.

3
SEALED FIRSTSHA-256 commitments, full preimages later
2
REFUSEDNot misses, not hits, not evidence
1
SCOREABLEWith an exact interval and every miss kept
The published anchor, reproduced first

Before guessing you, the machine must match them.

Bonneau, Preibusch and Anderson extracted every consecutive run of exactly four digits from the 2009 RockYou password leak. Wang and colleagues independently repeated that extraction on almost the same corpus. This browser recomputes the first percentage before any answer control unlocks.

BONNEAU INPUTS66,193 / 1,778,095

occurrences of 1234 / four-digit runs

LIVE DIVISIONcomputing

waiting for the check

WANG REPLICATION3.72%

n = 1,780,587, same extraction rule

The prediction controls are locked until this agrees.

ACT 01 / THE FAMOUS SEVEN

A match with no denominator.

Kubovy and Psotka found 7 from 28.4% of 558 people on the Yale campus in 1976. That sentence is real. It is also exquisitely sensitive to the sentence used to ask it.

Ask for a number from 6 to 15 and 7 falls to 17.3% among 237 undergraduates. Mention 7 as an example and it falls to 16.6%. In 1977, changing “digit” to “one-digit number” made 1 the mode at 18.0%, while 7 fell to 12.1%. A 1979 study found no seven effect among children aged 8 and 9.

Commitment 01

The first digit that comes to mind

sealing
Computing SHA-256 before enabling the choices.

Choose the first digit that comes to mind.

ACT 02 / THE FAMOUS THIRTY-SEVEN

A chart is not a response table.

Veritasium surveyed 200,000 community-post respondents in 2024. Its video publishes a visual distribution and names 37 and 73 among the standout choices. It does not publish per-number counts or a downloadable response table.

A separate traceable 2018 chart of 6,750 responses has 69, 77 and 7 as its leading choices. Prompt, audience and platform all changed. Neither source supplies the table this page would need to reproduce a population rate for its exact prompt.

Correction to the build spec: “no data” was too broad. Veritasium does show aggregate data in its video. What remains unavailable is the numerical table needed for an independent reproduction.
Commitment 02

A number between 1 and 100

sealing
Computing SHA-256 before accepting a number.

Locked until the digest is visible.

ACT 03 / THE COUNTED PIN

This one earns a score.

Two peer-reviewed papers give the same answer to two decimal places: among consecutive four-digit runs in RockYou passwords, 1234 accounts for 3.7% in Bonneau et al. and 3.72% in Wang et al.

Population before verdict: these are proxies taken from 2009-era breached web passwords, not banking PINs and not you. Their next leading entries are years such as 2007, 2006 and 2008. Wang's Chinese Dodonew data instead puts 1314 first at 7.25%. CSDN has 1234 at 5.91%; Yahoo has it at 4.51%. Vintage, culture and extraction rule all matter.

Nick Berry's 10.713% is also correct for his different rule: select passwords that are exactly four digits long. Bonneau and Wang select every consecutive run of exactly four digits inside passwords. A percentage is partly a decision about what enters the denominator.

Commitment 03

Choose only from the displayed decoys

sealing
Computing SHA-256 before displaying active choices.
Do not enter or select your real PIN. These are decoys supplied by the page. Do not reuse your choice as a secret.

Pick one displayed four-digit decoy.

That button does not record a choice of yours. It draws from crypto.getRandomValues and the result is filed as a machine draw.

The chance control, same predictor, different opponent

The exact object that predicts 1234 above plays 8,192 rounds against crypto.getRandomValues. It carries its state unchanged. With eight displayed options its baseline is 12.5%.

A 95% interval is built to miss sometimes, and this one is honest about how often. Against a true rate of exactly 12.5% over 8,192 rounds, an exact Clopper-Pearson interval excludes 12.5% computing of the time. That figure is summed from the binomial tails in this browser before you press, so a single AT CHANCE: FALSE below is the interval behaving as designed rather than a defect. Only a run of them means anything.

Ready after the prediction seal is visible.

ACT 04 / THE COLUMN THAT LOOKS COUNTABLE

The filename says “withcount.” The record says ranked.

SecLists ships a file a careful person might reach for next. It has 10,000 PINs in ranked order and a second column of integers. The current filename makes that column look like occurrences. The values do not behave like occurrences from any of the million-record sources above.

Passwords/Common-Credentials/four-digit-pin-codes-sorted-by-frequency-withcount.csv
ROWS / DISTINCT VALUEScomputing
RANGE / SUMcomputing
1234 IF TREATED AS COUNTScomputing
ROWS CARRYING 90computing
ROWS CARRYING 91computing
ROWS CARRYING 86computing

What the evidence supports: whatever this column is, it is not occurrence counts, and showing that needs no guess about which corpus produced it. The zero row settles it. Bonneau, Preibusch and Anderson, counting 1,778,095 four-digit runs in RockYou, report that “all possible 4-digit sequences occurred,” the rarest being 8439 with 10. Berry, counting nearly 3.4 million exactly-four-digit passwords, reports that “the 10,000 combinations of digits from 0000 through to 9999 were represented in the dataset,” the rarest being 8068 with 25. A genuine occurrence-count column over either corpus therefore has no zero row anywhere in it. This file has exactly one, and it is 8068. The share is the second contradiction. Treat the sum as a sample size and 1234 becomes , about times below the replicated 3.70%, and only times the 0.01% that a uniform draw over the 10,000 PINs would give.

What the column is stays undocumented. Its values are bounded above by 255 and never rise as rank increases, so a bounded score derived from rank order fits. The mapping is not a linear squeeze of rank into a byte: the plot above runs from single rows at the top through 326 rows sharing the value 90 and back to a single row at the bottom, where a linear quantisation of 10,000 ranks onto 256 values would put about 39 rows on nearly every value. We could not find the production formula published anywhere as of 2026-08-13.

The bounded-monotone signature the detector reports is necessary, not sufficient. Press “run detector controls” and it also flags a synthetic column that really is occurrence counts, taken from a corpus small enough that most PINs were never chosen. The zero row and the share are what carry this finding; the signature only says the file is the shape a score would be.

Correction to the build spec: upstream does disclose the list as ranked. Issue 169 is titled “4x digits Sorted By Use (PINs),” and the introducing 2018 commit points to pin_codes_sorted_by_frequency.zip. What upstream does not document is the mathematical meaning of the second column. The finding is narrower than the scout expected.

The source file itself is not shipped here. The page carries a derived run histogram of the second column, the ten published head rows and the already published last row. It cannot reconstruct the ranked guessing list. Recorded source SHA-256: 18e0ebf05f5a9ab24dfd1d59cff979e931bc0dee8d0663008d6bd3e4b0fc320b.

The check

What ran, what was chosen, what remains unknown.

REPRODUCED LIVE66,193 divided by 1,778,095, displayed to four decimal places and checked against Wang's independently reported 3.72%.
SEALED LIVEThree predictions, each with a fresh 128-bit nonce, SHA-256 digest, full revealed preimage, in-page verification and an outside-the-page shell command.
REFUSED LIVEActs 1 and 2 reveal their predictions but never call equality a hit or a miss. Their ledger rows remain explicitly unscored.
SCORED LIVEAct 3 scores the string inside commitment 03, never a fresh call to the predictor, and prints the sealed string beside a live re-call so that any divergence appears in the ledger instead of vanishing. It keeps the one result and reports an exact Clopper-Pearson 95% interval plus an exact two-sided binomial p-value.
CHANCE CONTROLThe identical PIN predictor plays an unbiased browser CSPRNG over the identical eight-option alphabet for 8,192 rounds. The control may fail in public, and the page computes and states, before you press, how often a correct 95% interval is expected to exclude 12.5% at that many rounds.
FORENSIC INPUTA derived 150-run histogram proves 10,000 rows, 150 values, monotonicity, range, sum and clusters without redistributing the ranked PIN list.
FREE CHOICESThe page chooses eight safe decoys, a 12.5% control baseline, 8,192 control rounds and a detector signature requiring a complete 10,000-row, zero-based, at-most-256-value monotone column. That signature is necessary and not sufficient, and the third detector control is the demonstration.
UNCERTAINTYThe PIN data are breached-password proxies, not banking PINs. The SecLists source hash is recorded, not re-fetched offline. The score column's production formula remains unknown, and this page does not guess which corpus the file was built from, because its finding does not need one.
The ethics line

A distribution can be shown without shipping the weapon.

Berry says he will not be “an enabler for script-kiddies” and refuses to release his source database. An earlier Wang manuscript says the researchers “avoid giving specific data” and show “aggregated statistical information.” This page follows that boundary. It shows enough to audit every claim and not enough to supply a ranked guessing list.

Nothing you type or choose leaves this browser. There is no analytics request, no remote form, no storage call and no fetch. Your three answers disappear with the tab.

Primary record

Sources attached to the numbers.

Kubovy & Psotka, 1976, pages 291-294558 Yale-campus respondents; 28.4%, 17.3% and 16.6% wording-sensitive results.
Kubovy, 1977, pages 359-364“One-digit number” changes the modal answer to 1 at 18.0%; 7 is 12.1%.
Wiegersma, 1979, pages 472-474No seven effect at ages 8 and 9; the effect appears at ages 10 and 11.
Bonneau, Preibusch & Anderson, Financial Cryptography 2012RockYou 1,778,095; 1234 = 66,193 / 3.7%; 8439 = 10; iPhone 204,508, 46 unseen, 1234 = 4.3%.
Wang, Gu, Huang & Wang, ASIA CCS 2017, pages 372-385RockYou 1,780,587 and 1234 = 3.72%; Dodonew 1314 = 7.25%; CSDN 1234 = 5.91%; Yahoo 1234 = 4.51%.
Nick Berry, PIN number analysis, 2012Exactly-four-digit password rule; nearly 3.4 million; 1234 = 10.713%; every one of the 10,000 combinations represented; 8068 = 25 / 0.000744%. The link goes to an Internet Archive capture on purpose: www.datagenetics.com now serves a self-signed certificate that expired on 2022-08-11, so the original address stops most browsers with a security interstitial.
Veritasium, Why is this number everywhere?, 2024200,000-response community survey, visual aggregate and narrated peaks, but no downloadable per-number table found as of 2026-08-13.
SecLists issue 169 and introducing commitThe upstream provenance calls the list sorted by use and frequency. It does not define the second-column transform.
The way out

Bring randomness the page cannot predict.

For the eight displayed decoys, three fair coin flips select an option uniformly. Or press “have the page draw one for me,” which uses rejection-sampled crypto.getRandomValues and files the result as a machine draw rather than as a choice of yours. Either method cuts the fixed predictor to its honest 12.5% baseline.

Do not use the resulting decoy as a real PIN. To create a real secret, use the random generator built into the system that will store it, follow that system's recovery rules, and never publish the result to this page or any other.