PIN Code Generator
A PIN nobody would guess first. Choose the length, decide whether digits may repeat, and let the filter throw out the patterns everybody else picks.
Unique digits cap the length at 10, since there are only ten of them.
Why random PINs matter more than you would think
Human-chosen PINs cluster badly. A widely cited analysis of several million leaked four-digit codes found the distribution is nothing like even: a handful of combinations cover a startling share of everything in use, which is exactly what someone guessing tries first.
| PIN | Roughly this share of all PINs |
|---|---|
| 1234 | About one in ten |
| 1111 | About one in seventeen |
| 0000 | About one in fifty |
| 1212 | About one in eighty |
| 7777 | About one in a hundred and forty |
Taken together the twenty most common codes account for something like a quarter of all PINs in use. Someone with three attempts and that list in front of them is playing a very different game from the one in 3,333 the maths suggests.
Dates are the other trap. Anything shaped like 19xx or 20xx is a pool of a hundred rather than ten thousand, and a day and month is barely better. Both are guessable by anyone who knows roughly when you were born, which is most people who would be in a position to try.
What the filter removes
With the obvious-pattern filter on, this generator rejects straight runs in either direction, all-identical digits, repeated two-digit patterns, year-shaped codes and the common list above, then re-rolls until the result looks like nothing in particular. It costs you a fraction of the possible codes and removes the ones an attacker starts with.
Remembering a code you did not choose
Chunk it. 837462 is hard to hold in your head, but 83 74 62 is three small numbers, and most people can carry three. Saying it out loud a few times in that rhythm is usually enough to fix it within a day of normal use.
Do not write it on the card, and do not store it next to the thing it opens. If you must write it down, bury it inside a longer number that looks like something else, such as a fake phone number where only you know which four digits matter.
Should I turn off repeated digits?
Only if you find unique digits easier to remember. Blocking repeats shrinks the pool of possible codes slightly, so it makes a PIN marginally weaker rather than stronger. It is a convenience setting, not a security one.
Is a 4-digit PIN enough?
For a phone or a card that locks after a few wrong attempts, yes. The lockout is doing the real work, not the length. For anything that allows unlimited guesses, use six digits or more.
Do you store the PIN?
No. It is generated in your browser and exists only on screen. Reload the page and it is gone.
Why is six digits so much better than four?
Each extra digit multiplies the search space by ten, so six digits is a hundred times four. Where a system lets you choose, the two extra taps are the cheapest security upgrade available.
Can I use the same PIN for my card and my phone?
Better not to. Someone who watches you unlock your phone on a train has then also watched you enter your card PIN, and the two are usually carried in the same pocket.
Is 0000 really that bad?
Yes. It sits near the top of every guessing list ever published, alongside 1234 and 1111. It is also the factory default on a lot of hardware, which is its own problem.