About the Random PIN Generator
This random PIN generator creates numeric codes for bank cards, phones, door keypads, alarm panels, voicemail and luggage locks. Pick a length from 4 to 12 digits and how many codes you need, and each digit is drawn with your browser’s cryptographically secure random number generator, so every allowed PIN is equally likely.
People are bad at choosing PINs: in the well-known DataGenetics analysis of 3.4 million leaked four-digit codes, “1234” alone made up about 11% of the set, and the top 20 codes covered roughly a quarter of all users. With “Avoid weak patterns” on, the generator rejects codes made of one repeated block (1111, 1212, 123123), straight runs up or down (1234, 9876), and — for 4-digit PINs — every year from 1900 to 2099 plus the 20 most common PINs. It then tells you exactly how many codes remain and how likely a thief is to guess yours in three tries.
Everything runs in your browser; nothing is sent or stored. For anything important, generate a fresh PIN here, memorise it, and never reuse the same PIN for your bank card and your phone. Add a seed only if you need to reproduce a list (for example, test data) — seeded codes are predictable and must not be used for real security.
How to use the random pin generator
- 1Choose a PIN length — 6 digits or more if your device allows it.
- 2Set how many PINs you want to generate.
- 3Keep “Avoid weak patterns” on to block codes like 1234, 1111 and birth years.
- 4Copy a PIN, memorise it and set it on your device.
- 5Change any input to generate a new batch.
Formula and method
Each digit is an independent uniform draw from 0–9, so there are 10^L PINs of length L. With weak-pattern filtering on, any draw that is weak is thrown away and redrawn (rejection sampling), which keeps every remaining PIN exactly equally likely.
Weak codes are counted exactly. Repeated-block PINs are 10^L minus the primitive strings, Σ μ(d)·10^(L/d) over divisors d of L (Möbius inversion); straight runs add 2 × (11 − L) for L ≤ 10; for 4 digits the years 1900–2099 and the top-20 common PINs are added without double counting (1919, 2020, 1212 and similar are already repeats). Entropy is log₂ of the allowed count, and a thief guessing blindly with 3 tries succeeds with probability 3 ÷ Allowed.
- L
- Number of digits in the PIN
- Weak
- Number of PINs blocked as weak patterns
- μ(d)
- Möbius function, used to count PINs that are one block repeated
Worked examples
A new 4-digit bank card PIN
Of the 10,000 four-digit codes, 314 are blocked: 100 repeated-block codes (0000, 1212…), 14 straight runs (0123–6789 and their reverses), 198 years from 1900–2099 that are not already repeats, plus 1004 and 1122 from the common list (6969, 1313 and 1010 are already repeats). That leaves 9,686 codes, about 13.2 bits, and a 3 ÷ 9,686 ≈ 0.031% chance of being guessed in 3 tries.
A 6-digit phone passcode
Six digits give 1,000,000 codes. Repeated blocks of length 1, 2 or 3 account for 100 + 1,000 − 10 = 1,090 of them, and straight runs add 5 up and 5 down, so 1,100 are blocked and 998,900 remain — almost 20 bits.
8-digit alarm code with no filtering
With filtering off, all 100,000,000 eight-digit codes are possible. Three blind guesses succeed with probability 3 ÷ 100,000,000 = 0.000003%.
Frequently asked questions
What are the most common PINs to avoid?+
In the DataGenetics study of 3.4 million leaked 4-digit PINs, the most common were 1234, 1111, 0000, 1212, 7777, 1004, 2000, 4444, 2222 and 6969. Birth years and dates (19xx, MMDD) are also very common and easy to guess from social media.
Is a 6-digit PIN much safer than a 4-digit PIN?+
Yes. A 6-digit PIN has 1,000,000 combinations versus 10,000 for 4 digits — 100 times more. With a 3-attempt lockout, a random 6-digit PIN is guessed blind only about 0.0003% of the time.
Are randomly generated PINs safe?+
Yes, as long as the generator uses a cryptographically secure source and you do not save the PIN next to the card or device. This tool uses Web Crypto in your browser and sends nothing over the network. Do not use seeded PINs for real accounts.
Should I avoid PINs that start with 0?+
No. A leading zero is perfectly valid on cards and phones and removing those codes would only shrink the pool. The generator keeps them, while blocking genuinely weak patterns such as 0000 or 0123.
How many 4-digit PIN combinations are there?+
There are exactly 10,000 four-digit PINs, from 0000 to 9999. After removing repeats, straight runs, years 1900–2099 and the 20 most common codes, 9,686 remain in this generator.
Does blocking weak PINs make the PIN easier to guess?+
Barely, and it is worth it. Removing 314 of 10,000 codes lowers the pool by about 3%, but attackers try those weak codes first, so a PIN outside them is far safer in practice. NIST guidance likewise recommends blocking commonly used and sequential secrets.