PIN Generator

How to use PIN Generator

1. Choose the length — 6 digits where the system allows it.
2. Generate, and regenerate if you get an obvious pattern.
3. Memorise it rather than storing it near the thing it protects.
4. Generated with crypto.getRandomValues rather than Math.random.
5. A random generator can still produce 1234 — regenerate if it does.
6. Four digits is 10,000 combinations; security comes from the lockout, not the length.

Human-chosen PINs are astonishingly predictable

Analysis of leaked PIN datasets has consistently found that 1234 alone accounts for around 10% of all four-digit PINs, and the top twenty cover roughly a quarter of them. 1111, 0000, 1212 and repeated pairs make up much of the rest, and a large block of the remainder are years between 1950 and 2000 — which is why a birth year is a poor choice. An attacker with three attempts and a list of the twenty commonest PINs succeeds far more often than the one-in-3,333 that random guessing would suggest.

Four digits is only 10,000 combinations

That is nothing against an offline attack and adequate against an online one, purely because the system locks after a few failures. This is why a bank card PIN is safe at four digits and a password is not at four characters: the security comes from the lockout, not the PIN. Where there is no lockout, four digits is meaningless. Six digits gives a million combinations and is the sensible choice wherever the system allows it.

Avoid the patterns you cannot see

A random generator will occasionally produce 1234 or 1111, which are perfectly random and terrible choices — generate again if you get one. Also avoid anything derived from you: a birth year, a house number, part of a phone number. And consider the physical channel: on a keypad, adjacent digits are easier to shoulder-surf, and a worn keypad can reveal which four digits are in use, which reduces 10,000 possibilities to 24.