Why people’s own PINs are easy to guess
When people choose a PIN, they lean on the same few ideas: 1234, 0000, 1111, a birth year, a wedding date, or the straight line 2580 down the middle of a phone keypad. A widely cited analysis of about 3.4 million leaked four-digit codes found that roughly a quarter of them were one of just 20 combinations. A thief with your wallet or phone gets only a few tries, so those few tries matter. A PIN drawn at random by a computer is no more likely than any other, which is exactly what you want.
What the three filters remove
Repeated digits removes any PIN with a digit next to itself, such as 1135, or a digit used three or more times. Runs and patterns removes three digits counting up or down, such as 345 or 987, and codes made of one short block repeated, such as 1212 or 123123. Common PINs removes a list of well-known codes, every year from 1900 to 2099, and anything that reads as a day and month, such as 0512 or 3107, along with six- and eight-digit dates. The panel shows how many PINs are left, so you can see the cost: for four digits about 6,350 of 10,000 remain.
How random PINs are made here
Each digit comes from crypto.getRandomValues, the secure random generator built into your browser, with rejection sampling so that every digit from 0 to 9 is equally likely. If a PIN fails a filter it is thrown away and a new one is drawn, so the PINs that pass are all equally likely too. Bulk lists contain no duplicates. Nothing is stored or transmitted, and the analytics this site uses record only which settings you used, never a PIN.
Choosing the length
Four digits is the norm for bank cards and many SIM cards, and it is safe because the card blocks itself after a few wrong attempts. If your phone, banking app or alarm lets you choose, six digits gives a hundred times more combinations at almost no extra effort. Eight digits or more suits door codes and safes that do not lock out after wrong guesses, though for a phone a longer alphanumeric password or passphrase is stronger still.
Keeping your PIN safe
Never write the PIN on the card or keep it in the same wallet, and do not send it by text message or chat. Cover the keypad with your other hand at cash machines and shop terminals. Banks and genuine customer service staff never ask for your PIN, by phone, message or email; anyone who does is attempting fraud. If you think someone has seen your PIN, change it at a cash machine or in your banking app straight away.