When the password consists of 4 characters, each being 0-9, there are 10,000 possible passwords; 14 bits are required to represent 10,000 possible combinations of anything:

  log(10000) / log(2) == 13.28771

With 5 characters, each 0-9, there are 100,000 possible combinations, and that requires 17 bits:

  log(100000) / log(2) == 16.60964

Therefore, 12345 offers 3 extra bits of security compared to 1234.

He's right. Decimal 5 is binary 101, hence 3 bits.

I wasn't literally referring to data bit, though. But he has a point.