PIN Generator

An analysis of 3.4 million four-digit PINs by DataGenetics found that 1234 alone accounted for about 11 percent, and the 20 most common PINs for over a quarter of all PINs. Birth years, dates such as 1225 or 0101, and patterns on the keypad are also very common. A thief who tries the most likely PINs first has a much better chance than the 1 in 10,000 that a random four-digit PIN would give.

Each digit comes from crypto.getRandomValues, the browser's cryptographically secure random generator. Random bytes from 250 upwards are thrown away and drawn again, so every digit from 0 to 9 is exactly equally likely (no modulo bias). When a filter rejects a PIN, the whole PIN is drawn again rather than patched, so every PIN that passes the filters is equally likely too. Filtering removes about 8 percent of four-digit PINs (805 of 10,000), so 9,195 remain equally likely, while the most-guessed PINs disappear.

A 4-digit PIN has 10,000 possibilities and a 6-digit PIN 1,000,000. That is enough only where wrong attempts are strictly limited, as with bank cards (usually blocked after three tries) and phone lock screens that add delays. For anything that can be attacked without limits, such as a file or an account password, use a long password or passphrase instead — the Password Generator makes those. If your device allows longer PINs, 6 or more digits are a good choice.

Don't reuse the same PIN for your bank card, phone and door code, and never write it on the card. Shield the keypad when you type it. If you need to remember a new PIN, practise it a few times right away. This page doesn't save the PINs it makes, so copy the one you choose before leaving.