Is it possible to generate a 6-digit number using 256-bit encryption? Reading through some documentation on a piece of software, it claims that a 4-6 digit number is created using a 256-bit encryption process for the purposes of access control. The whole process works as follows:


A 4-6 digit "start code" (key?) is chosen by the user and programmed into the client software and into the management software as a new "client software record".
Using the management software, a new access code that will open the client software can be generated by selecting the previously created client software record.


It is clear that the 4-6 digit start code is used to introduce some form of uniqueness to each instance of the client software, and that start code is used to generate the resulting access code which when entered into the start screen of the client software, will allow the software to open.

My question is how could that process be using 256-bit encryption?

One thing which is clear is that there are only 10^6 possible combinations to open the client software thus in theory it wouldn't make much difference whether encryption or hashing is used to generate an access code.

Why such as number only access control is used is beyond the scope of this question. I am aware that this is pretty poor access control for software. Am just intrigued by the claim of 256-bit encryption.
I believe the claim of using "256-bit encryption" is primarily being done for marketing purposes.

Despite the best efforts of industry experts there are many people with a limited understanding of cryptography, and they associate "bigger key sizes" with "better security."  (While this is generally true, it's a very narrow view that excludes many important security factors; besides, key size differences become almost trivial beyond a certain threshold.)  Sadly, that's a surprisingly large number of people.  

Marketers know the money coming from people who don't understand the details spends just as well as money from people who do.

So what can you do about it, or what should you do about it?  Perform a security analysis reviewing what the product is capable of, given the facts you have.  Is six digits enough to stop people from guessing in the time limit given them?  Do they have a three-tries-then-lockout mechanism?  What is the value to you of the system they're protecting?  What is your risk exposure should it be violated?  Are there other access controls in place, and should there be?