PIN Code Generator
Generate secure numeric PIN codes of any length using crypto.getRandomValues.
About the PIN Code Generator
The PIN Code Generator produces cryptographically secure random PINs using the Web Crypto API. Unlike Math.random(), which is a pseudo-random number generator (PRNG) not suitable for security uses, crypto.getRandomValues() uses the operating system’s cryptographically secure random source — /dev/urandom on Linux, BCryptGenRandom on Windows, and SecRandomCopyBytes on macOS.
PIN codes are used for ATMs, phone unlock screens, door locks, alarm systems, and one-time passwords. The standard PIN length is 4 or 6 digits — the ISO 9564-1 standard specifies 4 to 12 digits, with 4 being the historical minimum (the original Bank of America ATMs in the 1970s) and 6 being the modern minimum for higher security (UK banks default to 6, US banks still default to 4).
The entropy of an n-digit PIN is n * log2(10) bits — about 13.3 bits for 4 digits, 19.9 bits for 6 digits, and 39.9 bits for 12 digits. At a million guesses per second (a typical rate for online attacks), a 4-digit PIN takes an average of 5 hours to crack, while a 6-digit PIN takes 200 days. Offline attacks with hashed PIN databases (using a GPU rig at a billion guesses per second) crack a 4-digit PIN in 4 milliseconds and a 6-digit PIN in 40 minutes.
This is why banks now enforce lockouts after 3 failed attempts — the lockout, not the PIN itself, is the security boundary. Without a lockout, even a 6-digit PIN is crackable offline. For this reason, PINs should never be used as the sole authentication factor; pair them with a second factor (a card, a biometric) for proper security.
How It Works
The generator uses crypto.getRandomValues(new Uint32Array(length)) to request length random 32-bit unsigned integers from the operating system’s CSPRNG. Each random integer is then reduced modulo the number of allowed digits to pick a single digit: digit = digitList[randomValue % digitList.length].
For 4-digit PINs with all 10 digits allowed, each digit has 1/10 probability, giving 10,000 total combinations. For 6-digit PINs, 1,000,000 combinations. For 12-digit PINs, 1 trillion combinations.
The modulo operation introduces a tiny bias when 2^32 is not a multiple of the digit count. For 10 digits, the bias is on the order of 10 / 2^32 = 0.00000023%, negligible for any practical purpose. For cryptographic applications requiring zero bias, the rejection-sampling method should be used instead, but for PINs this level of bias is irrelevant.
The ‘no repeated digits’ option uses Fisher-Yates-style sampling without replacement: it copies the digit list, picks a random index, removes that digit from the pool, and repeats. This guarantees every digit in the PIN is unique. The maximum PIN length with no repeats is 10 (the number of distinct decimal digits).
The common-sequence filter rejects PINs that match a list of well-known weak PINs: 1234, 1111, 0000, 1212, 2580 (the telephone keypad vertical line), and so on. According to a 2012 study by Nick Berry (Data Genetics) analyzing 3.4 million leaked 4-digit PINs, the top 20 most common PINs account for 26.8% of all PINs in use — the filter helps avoid the worst offenders.
Worked Examples
Default: 6-digit PINs, 5 generated, decimal digits, with common-sequence filter. Typical output: 472938, 815640, 392067, 584921, 706183. Each PIN has 1 million possibilities; the filter rules out ‘123456’ and similar.
4-digit PINs, 1 generated, no repeats. Typical output: 7392. With no repeats, the pool has 10 * 9 * 8 * 7 = 5040 possible PINs out of 10,000 — about half.
12-digit PINs, 1 generated, no filters. Typical output: 382917462051. This has 10^12 (1 trillion) possibilities and is suitable for high-security applications like a one-time password seed.
4-digit PINs, 1 generated, no leading zero. Typical output: 8472 (never starts with 0). Suitable for PINs displayed in fixed-width contexts where leading zeros would be confused with whitespace.
4-digit PINs, 1 generated, binary digits (0 and 1 only). Typical output: 1011. Only 16 possibilities (2^4). Useful for testing but not for security.
When to Use This Tool
- Generating a new ATM PIN when changing banks or replacing a card.
- Setting a phone unlock PIN (use 6 digits or longer for offline-attack resistance).
- Configuring a door lock, alarm system, or smart-home keypad.
- Generating a one-time password seed for two-factor authentication.
- Creating temporary access PINs for guests (e.g., a 4-digit Airbnb door code).
- Generating a parent PIN for parental controls on a streaming device.
- Seeding a software token (TOTP/HOTP) that needs a random starting value.
Limitations & Disclaimer
The generator uses crypto.getRandomValues(), the Web Crypto API’s cryptographically secure random source, which is suitable for PIN generation but not for raw cryptographic key material (use crypto.subtle.generateKey() for AES or RSA keys). The modulo operation introduces a tiny bias (less than 0.0001% for 10-digit selection) that is negligible for PINs but matters for cryptographic keys. The common-sequence filter is not exhaustive — it covers the top PINs from the 2012 Data Genetics study but does not filter all date-derived PINs. The PIN is displayed in plain text in the browser; copy it to a password manager immediately and clear the page. See our disclaimer for full terms.
Frequently Asked Questions
Why not use Math.random() for PINs?
<code>Math.random()</code> is a pseudo-random number generator based on xorshift128+ (in V8). Its output is statistically uniform but predictable from the internal seed state, which an attacker can sometimes recover by observing enough outputs. For PINs, passwords, or any security-sensitive use, <code>crypto.getRandomValues()</code> is required — it uses the OS’s cryptographically secure random source, which is unpredictable even to an attacker who can observe prior outputs. The NIST Special Publication 800-90A standard defines the requirements for CSPRNGs.
How long should my PIN be?
4 digits is the historical minimum and is still standard for US ATMs and phone unlock screens. 6 digits is the modern minimum recommended by NIST and is standard for UK and European bank cards. 8 digits or longer provides strong protection against offline attacks on hashed PIN databases. For phone unlock screens, 6 digits or alphanumeric passwords are recommended.
What makes a PIN weak?
A weak PIN is one that an attacker would guess early. The 2012 Data Genetics study found that 1234 accounts for 10.7% of all 4-digit PINs in use, 1111 for 6.0%, and 0000 for 1.9%. Dates (1900-2019 in MMDD or DDMM format) account for a huge share of PINs — an attacker who knows your birthday can guess your PIN with high probability. Avoid all-same-digit PINs, sequential PINs (1234, 4321), keypad patterns (2580, 0852), and any PIN derived from personal information.
Why does the filter remove common sequences?
Because attackers try common PINs first. The top 20 PINs account for over 26% of all PINs in use, so an attacker trying the top 20 PINs has a 1-in-4 chance of guessing correctly. Filtering them out prevents the generator from producing them. The list includes 1234, 4321, all-same-digit PINs, telephone keypad patterns (2580, 0852), and the ‘love’ sequence 5683.
Is the generated PIN truly random?
Yes — <code>crypto.getRandomValues()</code> uses the OS’s CSPRNG, which is cryptographically secure and unpredictable. The output passes the NIST SP 800-22 statistical test suite and the Diehard suite. The only known attack on <code>crypto.getRandomValues()</code> would be a compromised OS kernel, which is outside the threat model of any web-based tool.
Can the generated PIN be recovered?
No. The PIN is generated in your browser and displayed once. The generator does not store it, send it to a server, or write it to disk. If you close the page without saving the PIN, it is lost. For secure PIN storage, use a password manager like Bitwarden or 1Password, which encrypts PINs with AES-256 at rest.
Last updated: September 9, 2026 · Author: HT99 Tools Editorial Team