Random numeric codes for phones, SIMs, cards and door locks, with the codes every attacker tries first filtered out and the cost of that filter shown honestly: how many combinations remain, and what three tries against them are worth.
What a PIN is really up against
A four-digit PIN has 10,000 combinations, which sounds like a 0.03% chance for an attacker with three tries. Real PINs do far worse, because humans do not pick uniformly. The best public data, an analysis of 3.4 million leaked four-digit codes, found 1234 alone at 10.7%, the top three (1234, 1111, 0000) at nearly 19%, and the top 20 at about 27%. A thief with three attempts and the frequency table beats one in five wallets without knowing anything about the owner; add a glance at the ID card next to the bank card and birth-year codes fall too.
The fix is not a cleverer code, it is an actually random one. Uniform randomness pushes the three-try success rate back to the theoretical floor, and that floor is what the stats under this tool report.
How to use this generator
Set the length, click a code to copy it, regenerate for a fresh batch; up to 100 at once with copy-all and a .txt download for provisioning device fleets or seeding test data. Every digit comes from crypto.getRandomValues with rejection sampling, the same unbiased draw our password generator uses, and nothing leaves the tab.
The four boxes below the tool are the honest version of a strength meter: remaining combinations, how many codes the obvious-filter removed, the entropy in bits, and the odds that a random guesser wins within a typical three-try lockout.
What --no-obvious removes, exactly
Most PIN pages either allow 1111 or silently filter "weak" codes without saying what that means. This one names the rules and counts them:
| Rule | Examples | Codes removed (4 digits) |
|---|---|---|
| repeated single digit | 0000, 7777 | 10 |
| ascending / descending runs | 1234, 9876 | 14 |
| repeating patterns | 1212, 4747 | 90 |
| years 1900–2029 | 1984, 2001 | 128 |
| top-20 leaked list, rest | 1004, 1122 | 2 |
244 codes in total, 2.4% of the space, costing 0.036 bits of entropy. That trade is worth it because the removed 2.4% would absorb roughly a quarter of real-world guessing attempts. At six digits the same rules remove 1,100 codes of a million (090909 and 121212 count as repeating patterns too); at prime lengths only same-digit codes can repeat and the filter gets even cheaper. The counts in the stats are computed exactly from these rules, not estimated, and the filter works by redrawing the whole code rather than nudging digits, so no position becomes predictable.
4 digits or 6
Six random digits turn 1-in-3,333 three-try odds into 1-in-333,333, which is why phones made 6 the default and why you should take the offer everywhere a keypad allows it. The exceptions are systems that hard-cap at four (many bank cards, door intercoms, older alarm panels); there a random four-digit code plus the device's try counter is still a perfectly sound lock.
What extra digits do not fix: anyone watching you type, the smudge trace on a screen, or a code reused across devices. A PIN is a short secret by design and leans entirely on its enforcement hardware, which is the next section's point.
Where a PIN is safe, and where not
A PIN is safe exactly where something slow, lockable and non-copyable checks it: the secure element in a phone that enforces escalating delays, a SIM that bricks after three misses, a card terminal that eats the card. In all of those, 10,000 or 1,000,000 combinations vastly exceed the handful of tries an attacker gets, and the honest risk is observation, not brute force.
The mistake is exporting that intuition to places with unlimited tries. A numeric code as a website password, a 6-digit ZIP archive password, a "PIN-protected" PDF: all of these are offline-guessable, and a GPU walks the entire 6-digit space in well under a second. If the thing being protected can be copied and attacked elsewhere, it needs a real secret; our passphrase generator is the right tool the moment a human still has to remember it.
Random PINs on the command line
| Command | Notes |
|---|---|
python3 -c "import secrets; print(''.join(secrets.choice('0123456789') for _ in range(6)))" | Digits, not a number: leading zeros survive. |
LC_ALL=C tr -dc '0-9' </dev/urandom | head -c 6; echo | Draws straight from the OS randomness pool. |
node -e "console.log(Array.from({length: 6}, () => require('crypto').randomInt(10)).join(''))" | randomInt does the unbiased sampling for you. |
The recurring bug in homegrown one-liners is going through an integer: secrets.randbelow(1000000) happily returns 42, and somewhere between the int and the label on the door the leading zeros vanish. Every recipe above builds a string of digits directly, which is also what this page does.
PIN questions
What is the most common 4-digit PIN?
1234, by a huge margin: in the 2012 DataGenetics analysis of 3.4 million leaked four-digit codes it made up 10.7% of everything, followed by 1111 at 6.0% and 0000 at 1.9%. The top 20 codes together covered about 27% of all PINs in the dataset. The pattern behind the list is depressingly consistent: keypad walks, repeated digits, couples of pairs like 1212, and birth years, with almost every year from 1940 to 2005 appearing far above chance.
How long does it take to crack a 4-digit PIN?
It depends entirely on where the PIN is checked. Against hardware with a try counter, effectively forever: an iPhone allows a handful of attempts before escalating delays and an optional wipe at 10, a SIM card blocks after 3, most bank cards swallow the card at the ATM after 3. Against anything offline, instantly: 10,000 combinations is nothing, a laptop tries them faster than you can read this sentence. That is why a 4-digit code protecting a ZIP file or a web account is a mistake while the same code on a smartcard is fine.
Is a 6-digit PIN really more secure than a 4-digit one?
It has 100 times the combinations, one million against ten thousand, so a random guesser within a 3-try limit goes from a 1-in-3,333 chance to 1 in 333,333. That is a real improvement and the reason phones moved to 6 digits as their default. It does nothing against the other ways PINs fall: shoulder surfing, smudge patterns on the glass, a birthday the attacker knows, or a leak of the code itself. Length helps exactly one attack, guessing, and only when the digits are random.
Should I use my birthday as a PIN?
No, and it is one of the most exploitable choices. Leaked-PIN research shows massive clusters on DDMM, MMDD and YYYY patterns, and a lost wallet usually contains the birthday on an ID card right next to the bank card. Attackers with three tries at a stolen card test date patterns first for exactly this reason. The same applies to anniversaries, kids' birth years and postcodes: anything a stranger can look up or read off your documents disqualifies itself.
Why do phones refuse PINs like 1111 or 1234?
Because the try-limited lock only works when a thief's first guesses miss. iOS shows "This passcode can be easily guessed" for repeated and sequential codes, and Android vendors ship similar blocklists. With three to five attempts before lockout, an attacker's entire strategy is the top of the frequency list; blocking that top costs almost nothing in usable code space (a few hundred of 10,000 codes) and removes the bulk of successful guesses. It is the same trade this generator's --no-obvious flag makes, with the numbers shown.
How do I generate a random PIN in Python or JavaScript?
Python: "".join(secrets.choice("0123456789") for _ in range(6)), using the secrets module, not random. JavaScript: crypto.getRandomValues with rejection sampling per digit, or in Node.js "".join via crypto.randomInt(0, 10). The classic trap is generating a number instead of a string: secrets.randbelow(10000) returns 42 as easily as 9942, and formatting it without zero-padding produces a 2-digit "PIN" or, worse, str(42).zfill(4) written after the leading zeros already got lost in an int conversion somewhere. Generate digits, not numbers.
Are PINs with repeated digits weaker?
A uniformly random code containing a repeat, like 5535, is exactly as strong as any other random code; randomness does not owe you visual variety. The codes worth avoiding are the fully patterned ones (1111, 1212, 1234), because they top the guess lists every attacker starts with. There is a subtlety worth being honest about: excluding patterns shrinks the code space slightly, which is why this generator shows the exact count it removed and the entropy after removal, instead of pretending the filter is free.
What is a PUK code and what happens after three wrong SIM PINs?
After three wrong PIN entries a SIM card locks itself and demands the PUK (PIN Unblock Key), an 8-digit code printed on the original SIM letter and shown in most carrier account portals. Entering the PUK resets the PIN. The PUK itself allows ten attempts; after the tenth failure the SIM is permanently dead and the carrier has to issue a new card. Do not guess at a PUK, look it up. Every failed try is irreversible.