PIN Generator
Generate random numeric PINs (4, 6, 8 digits). Cryptographically secure, with optional filter for weak patterns like 1234 or 0000.
Last updated: April 2026 · Runs in your browser · No sign-up
PIN do's and don'ts
- Don't: birthdays, years, 1234, 0000, same digit repeated.
- Don't: patterns on the keypad (2580 is vertical on phones).
- Do: use a password manager's PIN field if your app supports it.
- Do: rotate PINs you suspect may have been observed (shoulder-surfed).
Frequently Asked Questions
Why filter weak PINs?
The top 20 most common PINs (1234, 1111, 0000, 1212...) cover ~27% of all PINs in leaked databases. A truly random PIN with 'obvious' patterns removed is much harder to guess.
Is a 4-digit PIN secure?
Only 10,000 combinations — trivial to brute force if the attacker has unlimited attempts. 4-digit PINs work only when paired with rate limits (3 wrong tries = lockout), as phones do.
What about 6 vs 8 digits?
6 digits (1M combinations) is the minimum for online use without strong rate limiting. 8 digits (100M) adds a safety margin but becomes painful to type. Phones mostly moved to 6.
Is crypto.getRandomValues overkill for a PIN?
No. Math.random() is predictable enough that a determined attacker could potentially reproduce a generated PIN. Crypto-secure is the right default, and it's no slower.