That has some nice attributes though. Five digits should be quite easy to memorize, avoiding written down passwords. Most phone PINS are four digits, so you avo

That has some nice attributes though. Five digits should be quite easy to memorize, avoiding written down passwords. Most phone PINS are four digits, so you avoid phone PIN reuse. Realistically, the second factor is providing the bulk of the security. If that's a typical six digit TOTP, and they validate the PIN and TOTP together then an attacker has a one in one hundred billion chance of guessing correctly (10^5 + 10^6). Add in rate limiting by account and IP address, account locking, and other tools and that's extremely secure. You COULD have a longer password, but the extra entropy is probably excessive. It probably increases the chance of password reuse problems, so pragmatically it may be worse. I wouldn't recommend this approach in general, however.