Generating Random PINs and Codes (Safely)

A random PIN or code should come from a cryptographic random source and be long enough that guessing it is impractical. A 4-digit PIN has only 10,000 combinations; a 6-digit code has a million.

How long should it be?

• 4 digits — fine for a phone unlock with a lockout after a few tries, weak on its own
• 6 digits — the common standard for one-time verification codes
• 8+ characters (letters + digits) — for coupon or referral codes that must resist bulk guessing

Numeric PIN vs alphanumeric code

Use a numeric PIN when people type it on a phone keypad. Use an alphanumeric code (letters and digits) when you need many unique values in a short string — a few characters of Base36 cover millions of combinations.

Avoid weak patterns

Never use sequential or repeated digits (1234, 0000) or anything derived from a date. Draw from a true random source so codes cannot be predicted.

Generate now

Create numeric PINs in any range with the random number generator, or longer alphanumeric codes with the token generator. Related: How random number generators work.