PIN codes

The personal identification number arrived with the cash machine. James Goodfellow, a Scottish engineer at Smiths Industries, filed a patent in May 1966 for a dispenser that matched a machine-readable card against a number keyed in by the customer — the first description of a PIN as we use it. Barclays opened the first public machine at Enfield, north London, on 27 June 1967, built by De La Rue to a design credited to John Shepherd-Barron; it accepted paper vouchers and a six-digit code.

Four digits became the norm by anecdote and then by standard. Shepherd-Barron said he had planned on six until his wife told him she could only remember four, and most card schemes settled there. The ISO 9564 standard, first published in 1991, allows a PIN of four to twelve digits and governs how it is encrypted between the keypad and the issuer; the four-digit minimum it sets is the floor almost every card uses as its ceiling.

The weakness of short PINs is in the choosing, not the length. A 2012 analysis by Nick Berry of DataGenetics of 3.4 million four-digit codes from leaked password databases found that 1234 alone accounted for nearly 11% of them, that the top twenty covered more than a quarter, and that codes beginning 19 — birth years — were heavily over-represented. The least common was 8068. A machine that locks after three wrong tries gives an attacker who guesses 1234, 1111 and 0000 roughly a one-in-five chance against a human-chosen PIN and a one-in-3,333 chance against a random one.

That is what this generator is for: uniform draws with the patterns people reach for screened out, as placeholders in a test database or a mock-up — not as a code for a real account, because a seeded draw can be reproduced by anyone who knows the seed.

Key properties

• An n-digit PIN with repeats allowed has 10ⁿ possibilities: 10,000 for four digits, 1,000,000 for six.
• Forbidding repeated digits cuts that to 10!/(10−n)!: 5,040 four-digit codes and 151,200 six-digit ones.
• Screening out runs, repeats, keypad lines and years removes about 3% of four-digit codes (around 330 of 10,000), so the space stays close to uniform while the worst guesses are gone.
• Against a uniformly random four-digit PIN, three guesses succeed with probability 3/10,000 = 0.03%; against the distribution people actually choose, the same three guesses succeed roughly 20% of the time.
• ISO 9564 permits PINs of 4 to 12 digits and forbids the issuer from ever storing the PIN in the clear; only an encrypted block or a derived offset is kept.
• These PINs come from a seeded generator and are reproducible by design — the one property a real PIN must not have.

Where they turn up

• The first cash machine, at Barclays in Enfield on 27 June 1967, was opened by the actor Reg Varney; a blue plaque marks the branch.
• Chip-and-PIN replaced signatures for card payments in the UK from 14 February 2006, after which a four-digit code became the everyday proof of identity for most purchases.
• Apple moved the default iPhone passcode from four digits to six with iOS 9 in 2015, citing a million possible codes against ten thousand.
• SIM cards carry a PIN and a longer PUK (PIN unblocking key); three wrong PINs lock the SIM, and ten wrong PUKs brick it.
• Test environments for payment terminals use fixed PINs such as 1234 for the published test card numbers, which is why a test-data generator needs to produce something less obvious.