PassGenFast

Short codes

PIN generator

A random PIN for a card, a phone or a door lock. Every combination is equally likely, including the ones that look too simple to be random.

Generator

Generating…

Strength: Very weak

13 bits of entropy

An offline attacker could find this in seconds or less. Add length.

At 100 billion guesses a second, an offline attack would find it instantly. That rate assumes a site stored your password badly; a properly stored one takes far longer to attack.

4
312

A PIN is short by design, so it is weak by design. It only holds up because the card or phone behind it stops guessing after a few tries.

Generated in your browser with crypto.getRandomValues. Nothing is sent to us, and the page keeps working with your connection switched off.

A PIN is weak on purpose, and that is fine

Four digits give ten thousand possibilities. A laptop works through that in a fraction of a second. By the standards used for passwords, a PIN is indefensible — and yet PINs protect bank cards perfectly well, because the security is not in the number at all. It is in the card refusing a fourth wrong attempt.

That is worth understanding, because it tells you exactly when a PIN is safe and when it is not. Behind a chip that locks after three tries, four digits is enough. As the password on something an attacker can copy and attack offline at their leisure, it is no protection whatsoever.

How many combinations each PIN length gives
DigitsCombinationsEntropy
410,00013.3 bits
61,000,00019.9 bits
8100,000,00026.6 bits
121,000,000,000,00039.9 bits

Every extra digit multiplies the work by ten. Even so, twelve digits is still under 40 bits — less than a seven-character random password. Digits are simply a small alphabet.

Why we do not filter out the “bad” ones

Plenty of generators quietly skip 0000, 1234 and the other patterns that turn up at the top of every leaked-PIN list. It sounds sensible and it makes things slightly worse. Every PIN you remove is one an attacker no longer has to try, and the remaining ones each become a little more likely. A uniform draw is the strongest thing on offer.

The reason those PINs dominate the leak lists is not that random generators produce them too often. It is that people choose them. Choosing 1234 is a problem; being handed it by chance is not, though you are free to draw again.

Choosing a PIN you will remember

  • Do not use a birthday, a year, or the last digits of your phone number. All of them are guessable from things people can find out about you.
  • Do not reuse the same PIN on your phone, your card and your front door. One shoulder-surf then opens all three.
  • Use the longest PIN the device accepts, not the shortest it allows.
  • If you must write it down, write it somewhere unrelated to the thing it opens.

Password generator

The main tool: random characters, any length, with an honest strength readout.

Passphrase generator

Real words you can actually remember, for the passwords you have to type by hand.

Username generator

Word pairs and invented handles for gaming, social and sign-ups.

Random string generator

Keys, tokens, salts and test data, without composition rules getting in the way.

UUID generator

Random v4 UUIDs, one or twenty-five at a time, straight from the browser's CSPRNG.

General information, not security advice for your particular situation. Last reviewed August 12, 2026.

Answers

Frequently asked questions

Why did it give me something like 1111 or 1234?

Because it is genuinely random, and a random four-digit PIN is 1234 exactly as often as it is 8305 — one time in ten thousand. Refusing to produce the ones that look too neat would shrink the pool and make every remaining PIN slightly easier to guess. If you would rather not carry an obvious-looking one, press the button again; just know that you, not the randomness, made that choice.

How weak is a four-digit PIN really?

Very, in isolation. Four digits is 10,000 possibilities, about 13 bits, which any computer exhausts instantly. A PIN is not protecting you by being hard to guess. It is protecting you because the card, phone or lock behind it only allows a handful of attempts before it blocks. Take that limit away and the PIN is worth almost nothing.

Should I use six digits instead of four?

If the device allows it, yes. Six digits is a million combinations instead of ten thousand — a hundred times more work for someone who has managed to get around the attempt limit, for two extra key presses. It is one of the cheapest security upgrades available. Eight is better still, if you can remember it.

Can I use a PIN as a password?

No. Digits alone give about 3.3 bits per character, against roughly 6.4 for a mixed-character password, so even a twelve-digit PIN is weaker than a seven-character random password. Anywhere that lets you use letters, use the password generator instead, and keep PINs for the places that will only take digits.

Does the guidance say anything about PINs?

NIST allows short numeric secrets for this kind of use, and requires the systems behind them to limit failed attempts, which is exactly the point: the strength lives in the lock, not in the number. The same guidance pushes towards length over complexity for ordinary passwords and away from forced periodic changes.

Source: NIST SP 800-63B, memorized secrets