Passcode Generator: Random PINs and Numeric Codes

How to use the passcode generator

1. Select Numeric for a standard PIN or Alphanumeric for letters and digits.
2. Set the Length between 4 and 12 characters.
3. Check No repeated adjacent characters or No sequences if you want to filter out weak patterns like 1122 or 1234.
4. Choose how many codes to generate (up to 100) and click Generate.

How the passcode generator works

The tool builds each code character by character using crypto.getRandomValues, which provides cryptographically secure randomness directly in the browser. For a numeric passcode, the pool contains the ten digits 0 through 9. For an alphanumeric code, it uses the 26 uppercase English letters plus the 10 digits, giving a pool of 36 characters.

When you enable the no-repeats filter, the generator rejects any randomly chosen character that matches the one immediately before it and draws again. The no-sequences filter checks whether the last three characters form a run of consecutive values in either direction. For example, in the numeric set, 345 and 765 are rejected. In the alphanumeric set, the sequence check applies only to digits; letter runs like ABC are allowed because they do not represent the same predictable keypad pattern.

The no-repeats filter only blocks identical neighbours, so it works at every length, including 12 digits (for example 482901637251). If the filters ever make a code impossible to build, the tool returns an error rather than looping forever.

Number of possible combinations

The total number of unique codes depends on the character pool size and the length. Without any filters applied, the formula is simply pool size raised to the power of the length. Here is a reference table for common configurations:

Enabling the no-repeats or no-sequences filters reduces these totals slightly, but the remaining pool is still large enough for practical security in most non-cryptographic contexts.

Practical uses for random PINs

A random 6 digit number is commonly used as a one-time verification code sent via SMS or email. Because humans tend to pick memorable numbers when asked to invent a PIN, a passcode generator removes that bias and produces codes that are harder to guess.

• Two-factor authentication: Temporary numeric codes for login verification.
• Device locks: Setting a phone or tablet PIN that avoids birthdays or repeated digits.
• Event ticketing: Generating unique alphanumeric entry codes for attendees.
• Testing: Developers often need bulk lists of random PINs to populate test databases or simulate user input.

For longer secrets that include lowercase letters and symbols, consider a dedicated password generator instead. If you need to encode data rather than generate access codes, tools like Base64 encoding or a hash generator serve different purposes.

Why filter repeats and sequences

Research into real-world PIN usage shows that a small fraction of possible codes accounts for a large share of actual choices. Codes like 1234, 0000, and 1111 appear far more often than probability would predict. An attacker who knows this can try the most popular patterns first.

The no-repeats filter prevents adjacent identical characters, eliminating codes like 112233. The no-sequences filter blocks runs of three or more ascending or descending values, removing patterns like 123, 456, or 987. Together, these filters remove the weakest candidates while preserving uniform distribution among the remaining possibilities.

Note that filtering does reduce entropy slightly. For a 4-digit numeric PIN with no repeats and no sequences, the valid pool shrinks from 10,000 to 7,016 combinations. That is still sufficient for short-lived verification codes, but for high-security applications you should increase the length rather than rely solely on filters.

Uniformity and randomness guarantees

Each character position is filled by an independent draw from the character pool using rejection sampling. When a drawn character violates an active filter rule, it is discarded and another random value is selected. This approach maintains a uniform distribution across all valid outputs: every permissible code has exactly the same probability of being generated.

The underlying source of randomness is the Web Crypto API (crypto.getRandomValues), which draws from the operating system's cryptographic random number generator. This is the same source used for TLS session keys and is suitable for generating security-sensitive tokens. Unlike Math.random(), it is not a pseudorandom sequence that can be predicted from prior outputs.

Worked examples