Random PIN Generator: 4, 6 and 8-Digit PINs

...

This random PIN generator picks every digit with crypto.getRandomValues(), the cryptographic random number generator in your browser, using rejection sampling so 0 through 9 are exactly equally likely. It runs entirely on your device. I never see the PIN, and neither does anyone else unless you type it in front of them at the grocery store.

Pick a length and copy the PIN. Regenerate as often as you like, but take the first one you get rather than shopping for a pretty one (more on that below). If you are handing out door codes to a team or loading test data, set the count up to 100.

How many PINs are possible

Every digit has 10 options, so an n-digit PIN has 10ⁿ possibilities and log₂(10) ≈ 3.32 bits of entropy per digit. Entropy only counts if the PIN was chosen at random. A PIN you picked because it is your anniversary has about as much entropy as your Facebook profile.

For comparison, a random 16-character password from my strong random password generator is over 100 bits. PINs are weak by design. They get away with it because of attempt limits, which I cover below.

What the "avoid weak PINs" filter removes

With the box checked, the generator throws away and redraws any PIN that is:

• One digit repeated: 0000, 1111, all the way to 9999 (10 per length).
• A straight run up or down by one: 0123, 1234, ... 6789 and 9876, ... 3210. There is no wraparound, so 7890 stays in. For lengths above 10 there are no straight runs to remove.
• One of the 20 most common numeric passwords of that length (for lengths 4 through 10) from Nick Berry's PIN analysis at DataGenetics. For four digits that list is 1234, 1111, 0000, 1212, 7777, 1004, 2000, 4444, 2222, 6969, 9999, 3333, 5555, 6666, 1122, 1313, 8888, 4321, 2001 and 1010.

A bit of background on that list. Berry could not get real bank card PINs (nobody can, which is the point), so he used four-digit passwords from leaked password databases as a stand-in, almost 3.4 million of them. The results are grim: 1234 alone was nearly 11% of the set, and the top 20 covered 26.83%. If PINs were uniformly random, those 20 would cover 0.2%.

Why shrinking the space is fine

Yes, the filter technically makes the space smaller. For four digits it removes 32 of 10,000 PINs, leaving 9,968. Entropy drops from 13.288 bits to 13.283 bits. An attacker who knows exactly how this filter works could skip those 32 guesses, which improves their odds per guess from 1 in 10,000 to 1 in 9,968. That is a rounding error.

The benefit is practical rather than mathematical. A truly random 1234 is, in a pure math sense, as safe as any other PIN. But real attackers do not guess uniformly. They start with 1234, 0000 and the birth year on your license, because against human-chosen PINs that works. Someone who glances at your screen remembers 1111 instantly and forgets 830274. And when a coworker sees the door code is 2580 (straight down the middle of a phone keypad, which Berry found at #22), they will assume it was chosen lazily and tell people. Skipping a few dozen embarrassing PINs costs you nothing. Leave the box checked.

Under the hood the filter uses rejection sampling: generate a uniform random PIN, and if it is on the list, throw it away and generate a new one. That keeps every remaining PIN exactly equally likely.

Where PINs get used

• Phone and tablet unlock. The PIN guards the device and, on modern phones, is part of what protects the encryption of your data. The phone itself enforces delays and limits on wrong guesses.
• Bank and debit cards. The card or issuer blocks the PIN after a few wrong tries. Limits vary by bank.
• SIM PIN. Stops someone from putting your SIM in their phone and receiving your texts and calls. Too many wrong entries lock the SIM, and unlocking it needs a PUK code from your carrier. Change the SIM PIN from the carrier default.
• Carrier account and number transfer PINs. These protect against SIM swapping and port-out fraud, which is how attackers intercept SMS login codes. Make this one random and unique.
• 2FA backup and app lock PINs. Authenticator apps, password managers and banking apps often use a PIN to unlock on your device.
• Door codes, alarm panels, lockboxes and garage keypads. These often have no lockout at all, so length matters more here.
• Voicemail. Old voicemail systems with default PINs are a classic way into someone's messages.

Why birthdays and years are the first guesses

Because they work. In the DataGenetics data every PIN from 1900 to 1999 landed in the top fifth of all 10,000 codes. That is years of birth, graduations and anniversaries. His heatmap also shows a clear bump in codes that look like dates (MMDD, month then day), which is birthdays again.

Now think about where your bank card lives: in a wallet, next to a driver's license with your date of birth printed on it. A thief with your wallet gets to try 1234, 0000, your birth year and your MMDD before the card locks. A random PIN takes that away completely. The same goes for your phone: your birthday is on your social media, and your house number is on your house.

Why 6 digits beats 4

A PIN survives because the system limits guesses. If a system allows k wrong tries before it locks, the chance an attacker hits a truly random PIN is k divided by the number of possible PINs:

• 4 digits, 10 tries: 10 / 10,000 = 0.1%
• 6 digits, 10 tries: 10 / 1,000,000 = 0.001%
• 8 digits, 10 tries: 10 / 100,000,000 = 0.00001%

Every two digits you add makes the attacker's odds 100 times worse. And those numbers assume a random PIN. For a human-chosen 4-digit PIN, the DataGenetics top 20 alone covered over a quarter of the dataset, so an attacker with 20 tries would be very happy.

The flip side: a PIN with no attempt limit is barely a lock. If an attacker can guess offline, for example against a stolen hash of your PIN, all 1,000,000 six-digit PINs can be checked almost instantly. That is why a PIN is fine for a phone (the hardware enforces delays and limits) and terrible as a website password. If you are building something, rate limit and lock out PIN entry on the server or in secure hardware, and never let a PIN be the only thing protecting data that can be copied off the device.

If your phone lets you pick between 4 and 6 digits, pick 6. If it lets you use a longer PIN or a full passcode, and you unlock with a fingerprint or face most of the time anyway, go longer still. You will type it rarely.

Don't reuse a PIN

PINs get typed in public, on card terminals and ATMs, in view of cameras and people standing too close. Assume anything you type at a checkout will eventually be seen. If that same PIN also unlocks your phone, the person who saw it only needs to pick your pocket. Give your phone, your bank card, your SIM, your carrier account and your front door each their own random PIN. A password manager is a fine place to keep the ones you rarely use.

How to memorize a random PIN

Random PINs feel impossible to remember for about three days. Then your fingers learn them. Some things that help:

• Chunk it. Read 830274 as "830, 274". Two chunks of three are much easier than six loose digits.
• Make up a meaningless story. "830 is when I wake up, 274 is the bus I don't take." The story has to mean something to you and nothing to anyone else. Do not work backwards from something real, or you are back to a birthday.
• Rehearse on a schedule. Type it a few times right away, again an hour later, again tomorrow. Spaced practice sticks better than cramming.
• Use it. Change your phone PIN and you will have typed it 50 times by the end of the day.
• Keep a backup for a week. Write it on a card you keep at home, not in your wallet and never on the bank card itself, then shred it once it is in muscle memory. Or store it in your password manager.

Resist the urge to Regenerate until you get something with a "pattern" you like. That is how people end up back at 1122.

Generate a random PIN offline

If you would rather not use a website at all (reasonable, it's a PIN), these all use a cryptographic random source and keep leading zeros. I ran each of them. Change the 6 or the 1000000 for other lengths.

Python:

python -c "import secrets; print(f'{secrets.randbelow(10**6):06d}')"

Node.js:

node -e "console.log(require('crypto').randomInt(0, 1000000).toString().padStart(6, '0'))"

PowerShell 7:

[System.Security.Cryptography.RandomNumberGenerator]::GetInt32(0, 1000000).ToString("D6")

Two mistakes I see in homegrown PIN generators: using a non-cryptographic random function (Math.random(), Python's random module), and storing the PIN as an integer so 042917 quietly becomes 42917. Store PINs as strings. And if you are a developer issuing PINs to users, never store them in plain text. A PIN has so few possibilities that even a hash can be brute forced, so rate limiting is the real protection.

Need an identifier instead of a secret? The UUID generator is next door. Need a machine credential? Use the API key generator, because a PIN is far too short for that.

PIN generator FAQ

Is a random PIN from this generator actually random?

Yes. Each digit comes from crypto.getRandomValues, the cryptographic random number generator built into your browser, using rejection sampling so every digit from 0 to 9 is equally likely. There is no seed and no Math.random, and the PIN never leaves your device.

Should I use a 4-digit or a 6-digit PIN?

Use 6 digits whenever the device or service allows it. A 6-digit PIN has 1,000,000 possibilities instead of 10,000, so an attacker with the same number of guesses has 100 times less chance of hitting it.

What does the avoid weak PINs option remove?

PINs made of one repeated digit such as 1111, straight runs up or down such as 1234 or 4321, and the 20 most common numeric passwords of that length from the DataGenetics PIN analysis. For a 4-digit PIN that is 32 of the 10,000 possibilities.

Doesn't filtering out weak PINs make the PIN easier to guess?

Only by a rounding error. Removing 32 of 10,000 four-digit PINs lowers the entropy from about 13.288 bits to about 13.283 bits. In exchange you never end up with a PIN that attackers and nosy coworkers try first.

Is it safe to use my birthday or birth year as a PIN?

No. Dates and years are among the first things people guess, and your birthday is printed on your driver's license, which usually sits in the same wallet as your bank card.

Can I use the same PIN for my phone, bank card and SIM?

Please don't. If someone watches you type it once at a checkout, they now have the PIN for everything else you own. Give each one its own random PIN.

Why do some generated PINs start with 0?

Because 0 is a digit like any other. About one in ten random PINs starts with 0. If you store PINs in a spreadsheet or database, store them as text, or the leading zero disappears.

Related tools: strong random password generator, memorable password generator, API key generator, UUID generator.

-Sethers