Random 4-Digit PIN Generator
Generate a random 4-digit PIN from 0000 to 9999 using the browser's cryptographic random source. Every digit is uniform and leading zeros survive.
Loading tool…
How It Works
This random 4-digit PIN generator is the password generator pinned to a four-digit numeric preset, and the interesting part is not the length but how each digit is chosen. The page opens with length 4 and the numeric character set, so every draw is a string of four characters from 0 to 9, with leading zeros kept.
Random source. Bytes come from crypto.getRandomValues, the browser's cryptographically secure generator. Math.random is never called: it is seeded predictably enough that an attacker who sees a few outputs can model the next one, which is unacceptable for a secret that unlocks something.
Turning bytes into digits. The naive approach is byte modulo 10, but 256 is not a multiple of 10. Values 0 to 255 would split into 26 chances for digits 0 to 5 and 25 for digits 6 to 9, a small but real bias. Instead the generator computes 25 × 10 = 250 and discards any byte of 250 or above, drawing a replacement. Each of the ten digits then maps to exactly 25 byte values, so all ten are equally likely.
Repeats and zeros. Digits are drawn independently, so 0000, 1111 and 9090 are all legitimate outcomes, and 0007 keeps its leading zeros because the digits are concatenated as text rather than converted to a number. Every value from 0000 to 9999 has the same probability: one in ten thousand.
Where a PIN is appropriate. Four digits suit a device unlock, a SIM card, a door keypad or a bank card, all of which pair the PIN with a limit on wrong attempts. It is the wrong tool for an account password, because ten thousand combinations fall to a script in seconds if nothing rate-limits the guesses.
Generation happens in the tab. Nothing is logged, stored or transmitted, so the PIN exists only where you put it next.
How to generate and install a PIN
- Confirm the preset still reads length 4 and "Numbers only": changing either setting no longer produces a 4-digit PIN.
- Press Generate. Every run draws fresh bytes, so regenerating because you dislike a value such as 1111 is harmless.
- Enter the PIN into the device immediately and close the tab; the value was never transmitted, logged or stored anywhere.
- If the device needs six digits instead, set the length to 6 for a six-digit secret — it has a million combinations, but it is a different kind of code with different backup rules.
What each generator setting is good for
| Secret | Preset that produces it | Possible values | Acceptable where |
|---|---|---|---|
| 4-digit PIN | length 4, numeric (this page) | 10,000 | Device unlock, SIM, bank card, door keypad — each locks after a few wrong attempts |
| 6-digit numeric code | length 6, numeric | 1,000,000 | Same class of device secret where six digits are required |
| 16-character password | length 16, all characters | 7016 | Account passwords reachable over a network |
| 64-character secret | length 64, all characters | 7064 | Key material, tokens and API secrets |
Examples
Input
Page preset: length 4, character set "Numbers only" — press GenerateOutput
(4 random digits, e.g. 4821)Four digits, no separators, a fresh value on every run. The tool never returns a stored or reused PIN.
Input
Page preset: length 4, character set "Numbers only" — press GenerateOutput
(4 random digits, e.g. 0007)Boundary case: a leading zero. Digits are joined as text, so 0007 stays four characters and is never shortened to 7.
Input
Page preset: length 4, character set "Numbers only" — press GenerateOutput
(4 random digits, e.g. 9090)Repeats are normal. Each digit is drawn independently, so 9090 and 1111 are as likely as any other value.
Frequently Asked Questions
- How many possible 4-digit PINs are there?
- Ten thousand, from 0000 to 9999. Each of the four positions has ten options and the digits are independent, so the space is 10 × 10 × 10 × 10. That is small enough to list exhaustively, which is why a PIN only works when the system also limits wrong attempts.
- Is a 4-digit PIN secure enough for a bank card?
- For a card, yes, because the card is locked after a handful of wrong entries and the attacker must also physically hold it. Online, where guesses can be automated, four digits is far too short. Use this generator for device and card PINs, and a longer random password for anything reachable over a network.
- Can the PIN start with a zero?
- Yes, and it is generated as often as any other first digit. The four digits are joined as text, so 0007 stays four characters instead of collapsing to the number 7. If a form rejects a leading zero, that form is storing the PIN as an integer and has a bug.
- Is the PIN truly random or just pseudo-random?
- It is drawn from the operating system entropy pool through the Web Crypto API, not from a seeded formula. Bytes are taken in blocks and six of every 256 values are discarded so that no digit is favoured. Nothing about the time, the browser or previous PINs influences the result.
Limitations & Accuracy
A four-digit PIN has only 10,000 combinations, so it is safe only where the device limits wrong attempts; it is not a substitute for a password on anything reachable online. Repeats and sequences such as 0000 or 1234 are possible because digits are independent and nothing is filtered. The length and character-set controls remain editable, so changing them stops producing a 4-digit PIN. The generator draws from the operating system entropy pool but cannot prove the result is unguessable if the device itself is compromised.