Random PIN generator
Random 4, 6 or 8-digit PINs from your browser’s cryptographic random source, with the obvious ones like 1234 and 0000 filtered out.
Why a random PIN matters
A four-digit PIN has only 10,000 combinations, but people don’t spread their choices across them. Leaked PIN datasets show the same handful at the top every time: 1234, 1111, 0000, 1212, 7777, then birth years and dates. Someone who finds your phone and tries the ten most common PINs has a real chance.
A random PIN removes that shortcut. With the filter on, the generator also drops the patterns an attacker tries first, which costs you about 5% of the four-digit space and removes the guesses most likely to work.
| Length | Combinations | With “skip easy” on | Use for |
|---|---|---|---|
| 4 | 10,000 | about 9,500 | Bank cards, SIM PIN |
| 6 | 1,000,000 | about 963,000 | Phones, 2FA backup PINs |
| 8 | 100,000,000 | about 94.5 million | Alarm codes, voicemail, router admin |
For anything that isn’t protected by a lockout after a few tries, use a real password instead.
Questions people ask
Is a random PIN better than one I pick?
Yes. People choose PINs very unevenly. In Nick Berry’s widely cited 2012 analysis of 3.4 million leaked four-digit PINs, 1234 alone accounted for about 11 percent, and the top 20 covered over a quarter. A random PIN gives every combination the same chance.
Which PINs does this generator avoid?
With “skip easy PINs” on, it rejects PINs with all identical digits (0000), straight runs up or down (1234, 9876), a repeated pair (1212), years 1900 to 2099 for 4-digit PINs, and digits that repeat three or more times in a row.
Should I use a 4-digit or 6-digit PIN?
Use 6 digits where the device allows it. A 4-digit PIN has 10,000 combinations; a 6-digit PIN has 1,000,000. Phones and cards lock or wipe after a few wrong tries, which is what makes short PINs workable at all.
Is the PIN generated securely?
Each digit comes from crypto.getRandomValues in your browser, with rejection sampling so no digit is favoured. Nothing is sent to a server.