It’s just numbers, no punctuation marks, no letters, no math symbols. No entropy really.
For most people that’s not an issue, but some people out there can guess them.
one way to mitigate that problem is simply to not load your mullvad account with more than 1 year of time at any given time. If your mullvad account has like…10 years of time then yeah, lots of people are going to mootch if they figure out which number has that
Or even if they don’t mootch, they could just remove the devices on your account and fuck with you
what kind of password has more entropy? one with capital and lowercase letters, numbers, math symbols and puncuation marks?
or the one with only numbers?
Is there really a citation needed for that?