How to Choose a Secure PIN Code (and Remember It)

A PIN protects your bank card, phone, SIM card and front-door alarm, yet most of us choose one in a hurry: a birthday, a year, a neat pattern on the keypad. Those are exactly the codes a thief tries first. The good news is that a secure PIN does not need to be long or complicated — it just needs to be unpredictable. Here is how to pick one, and how to make a random code stick in your memory.

Why human-chosen PINs are predictable

A four-digit PIN has only 10,000 possible values, from 0000 to 9999. That sounds like plenty when a card locks after a few wrong attempts — but only if every value is equally likely. People do not choose evenly. We gravitate to:

• Sequences such as 1234, 4321 or 2468.
• Repeated digits such as 0000, 1111 or 1212.
• Years and dates such as 1985 or 0712, often a birthday printed on a document in the same wallet.
• Keypad shapes such as 2580, a straight line down the middle of a phone keypad.

An attacker with three guesses will start with those, so a code from that list is effectively much weaker than its length suggests.

Four digits, six digits or more?

Each extra digit multiplies the number of possible codes by ten:

• 4 digits — 10,000 combinations
• 5 digits — 100,000 combinations
• 6 digits — 1,000,000 combinations
• 8 digits — 100,000,000 combinations

Bank cards are often limited to four digits, and that is acceptable because the card locks after a small number of failures. For a phone lock screen, where someone may watch you type or study smudges on the glass, six digits or more is a sensible upgrade. Where a device allows it, a longer passcode is better still.

How to get a strong PIN with the generator

The generator on this page draws each digit with the Web Crypto API on your own device, so there is no human bias in the result:

1. Choose the length: 4, 5, 6 or 8 digits.
2. Leave Avoid weak PINs switched on (it is the default). Sequences, repeated digits and year-like codes such as 1990 are rejected and drawn again.
3. Set how many PINs you want — up to 100 at once — if you need codes for several devices or a group of users.
4. Pick the one you like best and copy it. Leading zeros are kept, so 0472 is a perfectly valid result.

Nothing is stored or sent anywhere, so once you close the page the codes exist only where you put them.

Tricks for remembering a random PIN

A random code is only useful if you can recall it without writing it on the card. Try one of these:

• Chunk it. Read 739204 as “73 – 92 – 04” instead of six separate digits.
• Attach a story. 7392 might become “seven dwarves, three bears, ninety-two balloons”. Silly images stick best.
• Practice with muscle memory. Type the code a few times in a row on a calculator or notes app, then delete it.
• Use it right away. Change the PIN, then use it several times on the first day.

If you truly need a written reminder, keep it far away from the card and disguise it — never label it “PIN”.

One PIN per purpose

Reusing the same code for your card, phone and garage door means one shoulder-surfer unlocks everything. Give each important lock its own code, and change a PIN straight away if you suspect someone saw you enter it. For accounts that accept full passwords, a password or passphrase is stronger than any PIN.

PINs for teams, kiosks and shared devices

Workplaces often need many codes at once: door keypads, shared tablets, lockers or temporary guest access. The same rules apply, with a few additions:

• Give every person their own code so access can be revoked individually and audit logs mean something.
• Hand codes out privately, never in a group chat or on a whiteboard.
• Expire temporary codes for visitors and contractors as soon as the job is done.
• Avoid sequential codes such as 1001, 1002, 1003 for new staff; anyone who knows one can guess the next.

Generating the whole batch randomly in one go is the easiest way to make sure no two codes follow a pattern.

Pro tips

• Shield the keypad with your hand every time you type a PIN in public.
• Never use a date that appears on any document you carry.
• Wipe your phone screen now and then so smudges do not reveal your pattern.
• Switch to a six-digit code wherever a device offers the option.

Frequently asked questions