Why generate a PIN?
Humans are terrible at picking PINs. The widely-cited DataGenetics analysis of about 3.4 million exposed four-digit PINs found that 1234 alone accounts for roughly 11% of them, and the twenty most common PINs — 1234, 1111, 0000, birth years, repeated pairs — cover about 27% between them. Attackers try exactly those first. A uniformly random PIN removes every pattern: each digit is drawn independently with crypto.getRandomValues() using rejection sampling, so all 10,000 four-digit codes (or 10¹² twelve-digit codes) are exactly equally likely.
Know what a PIN can and can't do
Even a random PIN is a small secret: 4 digits is only ~13 bits of entropy, 6 digits ~20 bits, 12 digits ~40 bits. That's fine for its intended job — codes protected by rate limiting or lockout, like SIM cards, phone lock screens, bank cards that swallow after three attempts, or door keypads that throttle. It is nowhere near enough for anything an attacker can try offline: never use a PIN as a password, an encryption key or an API secret. For those, use a random password or passphrase instead.
Practical tips
Prefer 6+ digits when the device allows it, don't reuse a banking PIN elsewhere, and if a system lets you choose the length, longer is strictly better. As with every tool on this site, the PIN is generated on your device and never sent, logged or stored.