Requirements for PIN Policy with Enhanced Protection
Your PIN must be a secure, hard-to-guess code that meets the following requirements:
-
Contain at least 6 characters
-
For numeric mode, contain only digits (0-9)
-
For alphanumeric mode, contain only standard (UTF-8):
-
Letters, numbers, and symbols
-
Accented and language-specific characters
-
-
Should not be present in the Crescendo Authenticator Blocklist of commonly used PINs (see below)
-
Does not consist of repeated characters (for example, 111111 or aaaaaa)
-
Does not contain obvious sequential patterns (for example, 123456 or abcdef)
-
Does not contain common repeating blocks (for example, 123123)
-
Should not be a palindrome (for example, 123321)
Crescendo Authenticator Blocklist
Numeric Overrides - Non-Mathematical
Cultural and Spatial patterns that algorithms miss.
Source: NIST SP 800-63B-4, section 3.1.1.2 ("Commonly-used, expected" values).
| Value | Notes |
|---|---|
| 098765 |
Reverse numerical sequence |
| 520520 |
Cultural - "I love you" in Mandarin |
| 159753 |
Keypad - "X" shape |
| 753159 |
Keypad - Reverse "X" |
| 357951 | Keypad - Reverse "X" |
| 159357 | Keypad - "Diamond" |
| 1234567890 | Numerical sequence |
| 112233 | Numerical pattern |
| 123654 | Keypad - numerical flow |
Common Breach Corpus - "RockYou"
Expanded dictionary coverage made possible by removing numeric sequences.
Source: NIST SP 800-63B-4, section 3.1.1.2 ("Breach Corpuses").
| Value | Notes |
|---|---|
| password | None |
| password1 | None |
| pass123 | None |
| iloveyou | None |
| abc123 | None |
| qwerty | English keyboard layout |
| qwerty123 | English keyboard layout |
| qwertz | German keyboard layout |
| azerty | French keyboard layout |
| test1234 | None |
| 1q2w3e4r | Complex Walk |
| asdfgh | English keyboard layout |
| zxcvbn | English keyboard layout |
| 123qwe | None |
| abcedf | None |
| ghijk | None |
| admin | None |
| football | None |
| cookie | None |
| admin123 | None |
| baseball | None |
| computer | None |
| root | None |
| dragon | None |
| secret | None |
| guest | None |
| mustang | None |
| orange | None |
| user | None |
| monkeys | None |
| access | None |
| login | None |
| michael | None |
| daniel | None |
| welcome | None |
| charlie | None |
| jordan | None |
| master | None |
| superman | None |
| starwars | None |
| sunshine | None |
| batman | None |
| nicole | None |
| princess | None |
| jennifer | None |
| jessica | None |
Context Specific
Prohibited numeric IDs (for example, Sample Employee ID 112211).
Source: NIST SP 800-63B-4, section 3.1.1.2 ("Context-specific words").
| Value | Notes |
|---|---|
| 125478 | None |
| 112211 | None |
