Aside from the top two passwords (~17%), the distribution is not so bad. The next five passwords are only 5% of the distribution, which is much more reasonable.

Aside from the top two passwords (~17%), the distribution is not so bad. The next five passwords are only 5% of the distribution, which is much more reasonable. With 10^4 possible combinations, these obviously weren't designed to prevent a brute-force attack on their own. For example, with bank accounts the bank card provides a second factor and access attempts are monitored. There's also little point in hashing a 4-digit PIN. If the PINs were perfectly distributed, it would only take an average of 5,000 guesses to find the original PIN given the hash. Of course, this analysis has shown that they're anything but perfectly distributed; a quarter of them would take less than 20 tries.