The lookup ID is 4 letters, case-insensitive. The PIN is 4 digits. I did it this way for reasons of symmetry and to make it easy to tell it by voice. A github hash is much harder, since it's alphanumeric, case sensitive.

Also, the lookup ID doesn't have any digits in order to make it distinguished from the PIN. The whole effort is to make this as user friendly as possible.

A password and a hash are fundamentally different concepts... Your comment makes absolutely no sense in this context.

This is true as long as there are no other hashes that begin with those 4-5 characters.