Question 1

How secure is a 6-digit PIN?

Accepted Answer

A 6-digit PIN has 1,000,000 possible combinations. Against rate-limited devices (smartphones, hardware tokens) that lock or wipe after 10 wrong attempts, this gives the attacker only a 0.001% chance per attempt window, effectively unguessable. Against unrestricted offline brute-force, 6 digits = 19.9 bits of entropy = instant to crack. PINs are appropriate ONLY for devices that enforce attempt limits. They are not a substitute for a password on internet-facing accounts.

Question 2

Why disable consecutive repeats and sequences?

Accepted Answer

Human-chosen PINs cluster heavily around patterns: 1234, 1111, 0000, 1212, and birthdays account for ~25% of all real-world PIN choices according to research by Daniel Amitay (2011). When attackers brute-force a stolen iPhone or door lock, they try these top-25 PINs first, covering a meaningful fraction of users in seconds. Generating with the 'no repeats' and 'no sequences' filters guarantees your PIN isn't in the predictable-pattern bucket.

Question 3

Is this PIN actually random?

Accepted Answer

Yes, every digit comes from crypto.getRandomValues(), the browser's cryptographically secure PRNG. The filters (no repeats, no sequences) use rejection sampling: a random PIN is generated, checked against the filters, rejected and re-rolled if it matches a banned pattern. This preserves uniformity within the allowed set.

Question 4

What length should I use?

Accepted Answer

4 digits for low-stakes (toy, simple combo lock). 6 digits for phones, ATM cards, modern hardware tokens. 8 digits for high-value safes, server-room keypads. Apple specifically recommends 6 digits as the default after iPhone 6 (2014). The 4-digit minimum is essentially the floor below which PINs become trivially attackable even with rate limiting. A 4-digit PIN has only 10,000 possible values, and the top-20 common PINs account for ~25% of all choices.

PIN Generator

When to Use a PIN

Frequently Asked Questions