PIN Generator: Random 4 to 12 Digit PINs

How to use it

Set the PIN length from 4 to 12 digits. NIST SP 800-63B requires at least four and recommends six.
Tick the rules you want: No digit used twice, No three digits in order, or Avoid the 20 most common four-digit PINs.
Choose How many PINs to draw. The page draws them again each time you change a setting.
Press Copy or Download to keep the list. The page does not keep the PINs.

How the PINs are drawn

Each digit is a draw from crypto.getRandomValues, the secure random numbers of your browser. The draw is unbiased: a 32-bit value is used only when it falls below the largest multiple of the range, so each digit is equally likely.

When a rule is set, a PIN that breaks it is thrown away and drawn again. So every PIN that passes the rules is equally likely, and the entropy is the true figure for the rules you chose.

entropy (bits) = log2(number of PINs that pass the rules)

Which rules, and why

NIST SP 800-63B says that a PIN used as an activation secret is at least four digits, and that six or more is recommended. It also advises a blocklist of commonly used values.

A digit used twice (1122) and three digits in order (1234, 321) are patterns that make a PIN easy to guess. The list of the twenty most common four-digit PINs comes from the SecLists frequency list (MIT licence); 1234 and 0000 head it.

Four digits give 10,000 PINs; six give one million.
With no digit used twice, a PIN can be at most ten digits long, because there are only ten digits.

Worked example: four digits without runs or common PINs

Of the 10,000 four-digit PINs, 306 have three digits in order. That leaves 9,694, and 18 of those are common PINs (1234 and 4321 are already out). So 9,676 PINs pass the rules.

Their entropy is log2(9,676), which is 13.2 bits. Two to the power of 13.24 is about 9,676, the number of PINs that pass the rules.

Frequently asked questions

Are the PINs stored or sent to a server?

No. The PINs are drawn in your browser and shown on this page. Nothing is stored, sent or logged, and a reload removes them, so copy the ones you want first.

Why not use a birthday or a year as a PIN?

Dates and years are shared by many people, so they make poor PINs. A random PIN from this page is harder to guess, but it is also harder to remember, so keep it in a password manager if the service allows one.

What does the entropy figure mean for a PIN?

It is the number of bits in the choice. When the rules are known and the PIN is random, an attacker needs about half of 2 to the power of the bits in guesses on average, so each extra bit doubles the work.

Is a four-digit PIN safe enough?

NIST SP 800-63B allows four digits as the minimum and recommends six. Many devices and cards limit the wrong tries, so check that limit before you choose a short PIN for something important.

Why is the PIN length limited to ten digits with no repeats?

With no digit used twice there are only ten different digits to choose from, so a PIN cannot be longer than ten. The page refuses a longer PIN with that rule set.

Where does the list of common PINs come from?

It is the top of the SecLists frequency list of four-digit PINs, which is published under the MIT licence. The list covers four-digit PINs only, so the rule has no effect at other lengths.

Sources

Figures and text last checked on Tuesday, November 10, 2026.

Result