PIN code generator · 4 / 6 / 8 digits
Random PIN Generator
Generate a random 4 digit or 6 digit PIN code that avoids the combinations people - and attackers - try first. Check whether your current PIN is on the common list.
••••
Generated in your browser with crypto.getRandomValues(). Nothing is sent or stored. Verify it
What Makes a Good PIN?
A PIN has very few possible values - a 4-digit PIN has only 10,000 - so its security does not come from the maths. It comes from two things: the device or bank locking you out after a few wrong tries, and the PIN not being one of the handful attackers try first. The first is out of your hands. The second is what this random PIN generator is for.
People choose PINs the way they choose passwords: birthdays, years, repeated digits, straight lines on the keypad. That makes a stolen phone or card far easier to unlock than 10,000 combinations suggests. A PIN drawn uniformly at random - and then checked against the list of predictable PINs - takes that shortcut away.
- Use 6 digits wherever you can. Phones, many banking apps and some cards accept 6. That is 100 times more combinations than 4.
- Never reuse your card PIN for your phone, alarm or door code. One shoulder-surf should not open everything.
- Avoid anything personal: birthdays, anniversaries, house numbers, the last digits of your phone number.
- Leave "Avoid common PINs" on. The other rules - no repeated digits, no sequences - remove look-alike patterns but also shrink the pool; the readout shows by how much.
Most Common PINs to Avoid
The best public data on real PIN choices is the DataGenetics PIN analysis (Nick Berry, 2012). It studied about 3.4 million four-digit passwords exposed in data breaches - a proxy for PINs, since real card PINs are never published. 1234 alone accounted for 10.713% of them, the top three together for 18.61%, and the top 20 for 26.83%. An attacker who tries the three most common PINs on a card that allows three attempts wins almost one time in five; against a random PIN, the same three tries win 0.03% of the time.
| Rank | PIN | Share of PINs |
|---|---|---|
| #1 | 1234 | 10.713% |
| #2 | 1111 | 6.016% |
| #3 | 0000 | 1.881% |
| #4 | 1212 | 1.197% |
| #5 | 7777 | 0.745% |
| #6 | 1004 | 0.616% |
| #7 | 2000 | 0.613% |
| #8 | 4444 | 0.526% |
| #9 | 2222 | 0.516% |
| #10 | 6969 | 0.512% |
| #11 | 9999 | 0.451% |
| #12 | 3333 | 0.419% |
| #13 | 5555 | 0.395% |
| #14 | 6666 | 0.391% |
| #15 | 1122 | 0.366% |
| #16 | 1313 | 0.304% |
| #17 | 8888 | 0.303% |
| #18 | 4321 | 0.293% |
| #19 | 2001 | 0.290% |
| #20 | 1010 | 0.285% |
The same analysis shows the patterns behind the rest of the list: repeated pairs like 1212 and 6969 (all 100 "XYXY" pairs together are 17.8% of observed PINs), runs like 4321, birth years (every 19xx code sits in the most popular fifth), and 2580 - a straight line down a phone keypad - at #22. Our "Avoid common PINs" filter uses the published top-20 lists for 4 to 10 digits plus these rules, all of which you can check:
- a short block repeated: 1111, 1212, 123123, 12341234
- a straight run up or down: 1234, 4321, 012345
- for 4 digits: years 1900-2029 and the keypad lines 2580, 1470, 3690 (and reversed)
- dates: MMDD and DDMM for 4 digits; DDMMYY, MMDDYY and YYMMDD for 6; the same with a four-digit year for 8
The date rule is ours, not part of the DataGenetics data: birthdays are the classic advice-not-to-follow, and for 6 digits they are most of the filter. Use the "Is my PIN common?" box to test the PIN you have now - it is checked on this page and never sent.
How Weak Is a 4-Digit PIN? An Honest Table
Here is what a random PIN buys you, assuming the attacker can only guess a few times before a lockout:
| PIN | Combinations | Entropy (bits) | Guessed in 3 tries | Guessed in 10 tries |
|---|---|---|---|---|
| 4 digits (random) | 10,000 | 13.3 | 0.03% | 0.1% |
| 6 digits (random) | 1,000,000 | 19.9 | 0.0003% | 0.001% |
| 8 digits (random) | 100,000,000 | 26.6 | < 0.0001% | < 0.0001% |
| 4 digits (human-chosen) | 10,000 | - | 18.61% | 23.34% |
The last row uses the DataGenetics frequencies: trying the ten most common PINs covers 23.34% of real-world 4-digit codes.
Honest limit: with no lockout, every PIN is weak. An attacker with offline access to a PIN's hash, or a system that allows unlimited guesses, tries all 10,000 four-digit PINs in well under a second. A PIN protects you only together with a lockout, a hardware security chip or a card's retry counter. For anything that can be attacked offline - a password manager, disk encryption, a Wi-Fi network - use a password or a passphrase instead.
4 Digit vs 6 Digit PIN Codes, and Other Uses
A 6 digit PIN has 1,000,000 combinations against 10,000 for 4 digits, which turns a 1-in-3,333 lucky guess within three tries into a 1-in-333,333 one. iPhones default to a 6-digit passcode for this reason, and most banking apps accept it. Choose 4 only where the system forces it - usually payment cards and older door locks. With "Avoid common PINs" on, the generator draws from 914,769 six-digit PINs (19.80 bits); the most common six-digit choice in the data, 123456, alone covers 11.684% of people.
This tool also works as a plain random 4 digit number generator or random 6 digit number generator: switch "Avoid common PINs" off and every number from 0000 to 9999 (or 000000 to 999999) is equally likely, leading zeros included. That is useful for raffle numbers, test data, verification codes in development environments or temporary door codes. Set "How many PINs" to generate up to 100 at once and copy them as a list.
8-digit and longer PINs make sense for alarm panels, safes and PUK-style codes. If a field accepts letters too, you will get far more security per character from the password generator.
Random PIN Generator FAQs
Is this PIN generator really random?
Yes. Each digit comes from your browser's cryptographically secure random number generator (crypto.getRandomValues()) with rejection sampling, so every digit 0-9 is exactly equally likely. When "Avoid common PINs" is on, a candidate on the common list is discarded and the whole PIN is redrawn, so every remaining PIN stays equally likely.
What are the most common PINs?
In the DataGenetics analysis of 3.4 million four-digit codes, the top five are 1234, 1111, 0000, 1212 and 7777. 1234 alone accounts for 10.713%. The full top 20 is in the table above.
Is my PIN in the list of common PINs?
Type it into the "Is my PIN common?" box in the tool. It is checked against the published DataGenetics lists and the pattern rules (repeats, runs, years, dates, keypad lines) inside your browser. Nothing is sent or saved.
Should I use a 4 digit or 6 digit PIN?
Use 6 digits whenever the device or service allows it: it is 100 times harder to guess by chance. Keep 4 digits for systems that do not accept more, such as many payment cards.
Doesn't avoiding common PINs make my PIN easier to guess?
Barely. For 4 digits the filter removes 799 of the 10,000 PINs, leaving 9,201. That lowers entropy from 13.29 to 13.17 bits - while removing exactly the PINs attackers try first. The readout shows the precise count of PINs the generator can produce with your settings.
Can I use this as a random 4 digit number generator?
Yes. Turn off "Avoid common PINs" and every 4-digit number from 0000 to 9999 becomes equally likely, leading zeros included. The same works for 6 digits and other lengths up to 12, and you can generate up to 100 at once.
How do I remember a random PIN?
Use it several times on the first day and say it as pairs ("58 - 03 - 17"). Do not write it on the card. For phones, you can switch to an alphanumeric passcode and use a short passphrase instead.
Why does the crack time say "less than a second"?
Because without a lockout, any PIN can be brute-forced in milliseconds - there are only 10,000 (or 1,000,000) options. PIN security depends on the retry limit enforced by the card, phone or app. The "guessed in 3 tries" figure is the one that matters in practice.
What is the difference between a PIN and a password?
A PIN is numeric-only and short, and relies on a lockout. A password can use any characters and should be strong enough to survive offline attacks. Use the password generator for accounts and this PIN code generator for cards, phones and keypads.
Related tools