PIN code generator
Random digits with no birth dates, repeats or sequences like 1234.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
What matters
A PIN rests on the attempt counter, not on length
Four digits mean 10,000 combinations and roughly 13 bits of entropy. Brute force would take a fraction of a second if the card were not blocked after three wrong tries. That is why a PIN must never be used where attempts are unlimited: as an archive password, an encryption key or a website login.
The real danger is predictability. People pick 1234, 0000, 1111, their birth year and straight lines on the keypad. The generator throws such combinations away: sequences, triple repeats and anything shaped like a year.
If a service allows six or eight digits, take them: every digit adds 3.3 bits. A six-digit PIN is already a million options, an eight-digit one a hundred million.
Quick reference
How many digits to use
| Digits | Combinations | Typical use |
|---|---|---|
| 4 | 10,000 | bank card, SIM card |
| 5 | 100,000 | entry door, combination lock |
| 6 | 1,000,000 | phone, banking app |
| 8 | 100,000,000 | safe, gate, access control |
Never reuse one PIN
A code seen over your shoulder at a checkout also unlocks your phone — and with it your email and the confirmation codes from your bank. Card, phone and door need three different codes.
Questions
Frequently asked questions
Why is a four-digit PIN considered weak?
It holds only 13 bits of entropy: 10,000 combinations fall instantly. A PIN protects you not on its own but together with a limit on attempts and card blocking. If a service allows six or eight digits, take them.
Which PINs must I avoid?
Your birth year, 1234, 0000, 1111, 2580 (a straight line on the keypad), dates and repeated pairs. A noticeable share of all PINs are these, and an attacker starts there.
Can I use the same PIN for my card and phone?
No. A code glimpsed over your shoulder at a checkout also unlocks the phone, and with it your email and banking confirmations.
Next