A random 6-digit PIN is one of 1,000,000 equally likely codes, about 19.9 bits (6 × log2 10). That is tiny by password standards, and it works only because phones, cards and security keys cap the number of guesses: NIST requires authenticators to allow no more than 10 consecutive failed PIN attempts. Within that limit, an attacker's chance against a random 6-digit PIN is 1 in 100,000.
Why a random PIN, when people pick their own?
PINs chosen by people are remarkably predictable. A 2020 study of smartphone unlock PINs, presented at the IEEE Symposium on Security and Privacy, found that against an attacker allowed 10, 30 or 100 guesses, user-chosen 6-digit PINs provided little or no more security than 4-digit ones, because so many people pick patterns, repeated digits, dates and keypad shapes. The same study counted iOS's built-in blocklists, which flag common choices: 274 four-digit PINs and 2,910 six-digit PINs.
A random PIN removes the human pattern entirely. Every one of the million 6-digit codes has the same one-in-a-million chance, so the attacker's best strategy is no better than guessing in any order at all. With 10 attempts, that is 1 in 100,000. With a user-chosen PIN, the most popular guesses succeed far more often.
The rule
- Digits only, 0 to 9, each position chosen independently and uniformly.
- Length 6 by default, adjustable from 4 to 12.
- Leading zeros are allowed, because 0 is as likely as any other first digit; 012345 is a valid six-digit result.
- Nothing is filtered out. Sequences like 123456 and repeats like 000000 can appear, with the same one-in-a-million chance as any other code.
- Entropy is exactly digits × log2(10), about 3.32 bits per digit: 13.3 bits for 4 digits, 19.9 for 6, 26.6 for 8, 39.9 for 12.
Generate a PIN
- Leave the length at 6 or choose 4 to 12 digits to match the device or card.
- Press Generate.
- Say the digits to yourself in pairs or triplets a few times to learn them.
- Enter the PIN on the device, confirm it, and test it once while you still remember it clearly.
- If the device warns that the PIN is easy to guess, press Generate again and use the new one.
Why 123456 is not excluded
It sounds wrong to leave obvious PINs in. Here is the reasoning.
The odds are the same. A uniform generator produces 123456 exactly as often as 905182: once in a million draws. Excluding it would not make your actual PIN any harder to guess, unless you happened to draw it.
The cost of excluding is tiny, but so is the benefit. Removing all 2,910 PINs on the iOS six-digit blocklist would shrink the space by 0.3%, about 0.004 bits. The chance of drawing one of them in the first place is the same 0.3%.
Any exclusion list is arbitrary. Birthdays, years, keypad lines, repeated pairs: where do you stop? Each list removes some combinations, and attackers who know the list skip them.
If it bothers you, regenerate. Some devices, including iPhones, warn when a PIN is on their blocklist, and NIST recommends that authenticators discourage commonly used PINs. If you see that warning, press Generate again. Drawing again after a rare warning changes the odds by a negligible amount.
PINs only work with attempt limits
A 6-digit PIN would last a fraction of a second against an offline attack; a laptop can try all million codes almost instantly. PINs are safe only where something enforces a small number of attempts, usually hardware:
- NIST SP 800-63B-4 treats a PIN as an activation secret that unlocks an authenticator such as a security key or phone. It requires at least 4 characters (recommends 6), allows them to be entirely numeric, and says the authenticator must disable itself after no more than 10 consecutive failed attempts.
- iPhone and iPad add escalating delays after the third wrong passcode on the lock screen: 1 minute after the fourth, 5 minutes after the fifth, 15 after the sixth, 1 hour after the seventh, 3 hours after the eighth and 8 hours after the ninth. An optional setting erases the device after 10 consecutive failures.
- Payment cards follow ISO 9564-1, which allows PINs of 4 to 12 digits and recommends that a PIN assigned by the issuer be no longer than 6 digits for usability.
| Guesses allowed | 4 digits | 6 digits | 8 digits |
|---|---|---|---|
| 3 | 0.03% | 0.0003% | 0.000003% |
| 10 | 0.1% | 0.001% | 0.00001% |
| 100 | 1% | 0.01% | 0.0001% |
These are the chances that a random PIN is found within the stated number of guesses. They hold only for random PINs; for user-chosen ones, the first few guesses are far more likely to succeed.
Where a random PIN fits
- Phone and tablet lock screens; iPhone and iPad accept six-digit and four-digit codes as well as longer alphanumeric ones.
- SIM card PINs, app locks and door or alarm keypads.
- Security keys and smart cards that ask for a PIN before use.
- Card PINs, if your bank lets you choose one.
Where a PIN is the wrong tool
- Website and app passwords. Servers may allow far more attempts, and leaked databases can be attacked offline; use the password generator.
- Encrypting files. Nothing limits attempts against an encrypted file; use a passphrase or the encrypt text tool with a strong password.
- Anything where 4 digits is a choice, not a limit. If a device accepts longer PINs or an alphanumeric code, use more digits.
The PIN stays with you
Digits are generated inside your browser and shown only on your screen. The page sends nothing, saves nothing, and does not remember the PIN after you leave.
How the digits are drawn
Each digit comes from crypto.getRandomValues. A random byte has 256 possible values, which is not a multiple of 10; mapping it with a plain remainder would make 0 to 5 turn up slightly more often than 6 to 9. Values in the uneven remainder are therefore discarded and drawn again. Payment-industry guidance on generating random PINs (ISO 9564-5) asks for low-bias methods for the same reason. The methodology page explains how to check that generating makes no network requests.
FAQ
Why is 6 digits the default?
It is the minimum NIST recommends for PINs, one of the standard passcode lengths on iPhone and iPad, and the upper end of what ISO 9564-1 suggests for usability. It gives a million combinations against a 10-guess limit.
Is a 4-digit PIN safe?
It is ten thousand combinations, so 10 guesses succeed 0.1% of the time even for a random PIN. Use 6 or more wherever the device allows.
Can my PIN start with zero?
Yes, and roughly one in ten generated PINs will. If a device or form ever drops a leading zero, generate another PIN that starts with a different digit.
Why not avoid birthdays and years?
A random PIN is not more likely to look like a date than any other code, and an attacker cannot know which random code you got. Excluding dates would only make the generator less uniform.
Should I write my PIN down?
Not on the card or device it protects. If you need a reminder, store it in your password manager.
Is a longer PIN always better?
Each extra digit makes it ten times harder to guess, so yes, within what you can remember. For an iPhone or computer, a custom alphanumeric code or a passphrase is stronger still.
Sources
- Markert et al., "This PIN Can Be Easily Guessed" (IEEE S&P 2020)
- NIST SP 800-63B-4, activation secrets
- Apple Platform Security: passcodes and passwords
- ISO 9564-1:2017 sample, clause 8.1
- ISO 9564-5:2025 sample
Checked 2026-10-11.
Last updated: