Random PIN Generator

Why generate a PIN?

Humans are terrible at picking PINs: analyses of leaked datasets show 1234, 0000 and birth years cover a huge share of all 4-digit PINs, and attackers try those first. A uniformly random PIN removes every pattern — each digit is drawn independently with crypto.getRandomValues() using rejection sampling, so all 10,000 four-digit codes (or 10¹² twelve-digit codes) are exactly equally likely.

Know what a PIN can and can't do

Even a random PIN is a small secret: 4 digits is only ~13 bits of entropy, 6 digits ~20 bits, 12 digits ~40 bits. That's fine for its intended job — codes protected by rate limiting or lockout, like SIM cards, phone lock screens, bank cards that swallow after three attempts, or door keypads that throttle. It is nowhere near enough for anything an attacker can try offline: never use a PIN as a password, an encryption key or an API secret. For those, use a random password or passphrase instead.

Practical tips

Prefer 6+ digits when the device allows it, don't reuse a banking PIN elsewhere, and if a system lets you choose the length, longer is strictly better. As with every tool on this site, the PIN is generated on your device and never sent, logged or stored.