Random PIN generator
Create secure numeric PINs of any length from 3 to 12 digits — for phones, cards, lockers, alarm panels, door codes or app access. Generate a single PIN or a whole batch at once when you need to set up many devices or accounts, then copy the result.
How it works
Every digit comes from the browser’s Web Crypto API (crypto.getRandomValues),
a cryptographically secure random source — not the predictable Math.random. To
keep each digit perfectly uniform, the tool uses rejection sampling:
draw a 32-bit random value
reject it if above the largest multiple of 10 that fits in 32 bits
otherwise digit = value mod 10
Discarding the small “leftover” range removes modulo bias, so digits 0–9 each occur with equal probability. No PIN is stored or transmitted.
PIN strength by length
Longer PINs are exponentially harder to guess because every extra digit multiplies the search space by ten.
| PIN length | Possible combinations | Crack time at 10 guesses/min |
|---|---|---|
| 3 digits | 1,000 | ~1.7 hours |
| 4 digits | 10,000 | ~16 hours |
| 6 digits | 1,000,000 | ~69 days |
| 8 digits | 100,000,000 | ~19 years |
| 12 digits | 1,000,000,000,000 | millions of years |
Most online systems also lock an account after a few failed attempts, which effectively stops brute-force attacks on any length. But for physical devices with no lockout — a padlock combination or a keypad entry — longer really does matter.
Choosing the right length
- 3–4 digits — quick-access codes where convenience is paramount and the device has a lockout, such as a screen unlock PIN.
- 6 digits — bank card PINs and two-factor authentication one-time codes use 6 digits as the balance point between security and memorability.
- 8+ digits — alarm panels, high-security door codes, or provisioning codes that are not memorised but stored in a password manager.
Common mistakes to avoid
- Sequential runs like
1234or2468are the first patterns attackers try. A randomly generated PIN avoids this. - Repeated digits such as
0000or1111dramatically shrink the effective search space — they are a single guess, not one in ten thousand. - Reusing the same PIN across multiple accounts or devices means one leaked code compromises everything. Generate a fresh one per use case.
Generating 5 PINs of 4 digits might produce values such as 0476, 9183,
5028, 7641, 3309 — each drawn independently and uniformly with no patterns.
Everything is privacy-first: nothing leaves your browser and no PIN is ever stored.