Why not use Math.random()?
JavaScript's Math.random() is not cryptographically secure — its internal algorithm can, in theory, be predictable. For anything security-related (PINs, passwords, tokens), the correct choice is crypto.getRandomValues(), the cryptographically secure random number API in modern browsers.
How it works
Each digit is generated from a random byte from the Web Crypto API, using a rejection-sampling technique to avoid any statistical bias among digits 0-9.
100% local
The whole process happens in your browser — no PIN generated here is sent to any server.
Frequently asked questions
Is this PIN sent to any server?
No. All generation happens locally in your browser via JavaScript, with no network request.
What's the difference between this and a regular password generator?
A PIN is always numeric (0-9), typically used for cards, safes and locks — unlike an alphanumeric password with symbols.
How many PINs can I generate at once?
Up to 50 per generation, each independent and random.