Generate PINs that dodge the patterns attackers try first, repeated digits, sequences, and keyboard walks.
Analyses of leaked PIN databases consistently show the same weakness: a short list of predictable PINs, 1234, 1111, 0000, birth years, repeated pairs like 2525, covers a large share of real accounts, and attackers try those first. This generator samples digits with the browser's cryptographic random source and rejects candidates that contain ascending or descending runs of three or more, or (optionally) doubled digits, which removes the patterns that make PIN lists so skewed. Longer PINs help more than any cleverness: a random 6-digit PIN has a million combinations versus ten thousand for 4 digits, and many phones and banks now allow six.
Never reuse a PIN that encodes a birthday, anniversary or address number, even generated-looking ones, those are personal-data guesses, a different attack that randomness rules cannot block. Only the person choosing the PIN can avoid them.
What are the most common PINs to avoid? 1234, 1111, 0000, 1212, 7777, 1004, 2000 and birth years lead every leaked list. Between them, the top 20 PINs cover roughly a quarter of all accounts in breach analyses.
Is 4 digits enough? For a phone with attempt limits and remote wipe, a random 4-digit PIN is reasonable. For banking, choose 6 digits if the bank allows it, the guessing space grows a hundredfold.
Where are the PINs generated? Entirely on this device, with the cryptographic random generator built into the browser. They are not transmitted or stored anywhere.