How Can a PIN Be as Secure as a Password?

In a word: scope

It can be as secure — perhaps even more secure — because it’s used in a different way.

You can also choose to increase its security by using some of the same techniques we use for passwords in general.

One PIN per PC

Your Windows PIN works only on the one computer where you set it up. A thief would need both the PIN and the machine itself, so a faraway hacker can’t use it. Want more strength? Make your PIN longer, or make it password-like with letters and symbols.

The big difference: scope

The biggest difference between using a PIN and a password to sign in to your computer is that the PIN only works on the machine on which you set it up.

If someone knows your PIN, they’ll be able to sign in to your machine, but only if they also have physical access to the machine. If they can do that, your machine isn’t physically secure. With or without your PIN, anyone who has physical access to your machine can use any number of techniques to get at its contents.

There are at least two instances in which having an “easy” or even automatic sign-in puts you at additional risk:

• If you have saved logins or passwords in your browser, anyone can walk up to your machine and access those sites or credentials.
• If you use BitLocker to encrypt your data, logging in allows access to that data.

In those cases, the ability to log in — using that “easy to remember” PIN — could allow access, but it still requires physical access to the machine.

To an overseas hacker, a PIN is pretty much useless, unlike your password.

A PIN can be more secure

Many people fear a type of malware known as a keylogger.

When installed, keyloggers secretly record your keystrokes (and possibly much more), and send the recording to hackers. Log in to a website, for example, and the keylogger records both your username and password. Only something like multi-factor authentication can save you.

If you use a PIN to sign in to your machine, however, they can record anything they like, and it won’t get them anywhere. The PIN only works on your actual machine, which some remote hacker doesn’t have access to. Even if you use a Microsoft account to sign in to your machine, that PIN is useless everywhere else.

There’s an argument that using a PIN is more secure, since you never type your Microsoft account password into your machine. Keyloggers can’t log what you never enter.

Strength: treat it like a password

If a four-digit PIN still makes you uncomfortable, consider treating it like a password.

There are two ways.

The first is to make it longer. There’s nothing that says you have to use your four-digit ATM PIN as your Windows sign-in PIN. Use something longer — much longer, if you like. Just adding a single digit to your regular PIN makes it ten times stronger. A six-digit PIN is one hundred times as strong.

The second is to include letters and symbols in your PIN.

A PIN with letters and symbols is nothing more than a password. This, then, would act as an alternative password used to sign in only to this specific machine.

PINs are convenient

Using a PIN is, I believe, intended as a way to make signing in to your Microsoft account more convenient. As we’ve seen, it perhaps even makes it a little more secure (by not having to type in your actual account password). If you can log in with a PIN, you’re free to make your actual Microsoft account password long and complex. This strengthens the security of your online accounts, like your Outlook.com email, OneDrive online storage, and more.

Alternatively, if you’ve configured your Microsoft account to be password-less, meaning you’re using only Passkeys or other forms of authentication, you may be required to set up a PIN, or facial or fingerprint recognition as the primary way to sign in to your machine. Your online accounts are more secure (there’s no password to be compromised), but PINs move from a convenience to a potential requirement.

What if I forget my PIN?

When you sign in, there’s a link you can click on if you’ve forgotten your PIN.

This will take you online and have you authenticate with your Microsoft account some other way.

In my case, I’m offered:

• Windows Hello: the face, fingerprint, PIN, or security key option. We know we’ve forgotten the PIN, but if one of the others had been set up, then that can be used.
• Your password, if your account has one. (Meaning it’s not a “passwordless” account.)
• Email to an alternate recovery account, if one has been set up.

All of these are very much like the Microsoft account recovery process. Once authenticated, you’ll be signed into your machine and given the opportunity to set a PIN that you’ll hopefully now remember.