A Windows PIN never leaves your laptop. Your password travels to a server

When you set up Windows 11, it asks you to create a PIN, and plenty of people skip it on the assumption that four or six digits must be weaker than a long password. Microsoft argues the opposite, and its reasoning comes down to three points.

It only works on this machine

Your Microsoft account password opens your account from anywhere in the world. A Windows Hello PIN is tied to the device it was created on and is useless on any other. Someone who learns it would also need your laptop in their hands. It is also why each of your computers gets its own PIN.

It never leaves the device

A password travels to a server every time you sign in, so it can be intercepted on the way or stolen from the server if that is breached. The PIN is never transmitted and never stored on a server. Its job is to unlock an encryption key held on the device, and that key signs the sign-in request. The server has no copy of the PIN, and neither does Windows.

A chip stands guard

The key lives in the TPM, a security processor built to resist tampering and out of reach of malware. The TPM is also what stops someone working through number after number: after too many wrong guesses, the device locks. Windows does not tie old-style local passwords to the TPM, which is why Microsoft rates the PIN as the safer of the two.

Setting it up

• Open Settings, then Accounts, then Sign-in options.
• Under Ways to sign in, choose PIN (Windows Hello).
• Select Set up and follow the prompts.

Your account password does not go away: you still need it when you add a new device. You just stop typing it on the lock screen every morning.

Photo: A half-closed laptop on a desk. Photo by Luca Bravo, CC0 via Wikimedia Commons.

Source: Microsoft, Common questions about Windows Hello for Business (updated 8 October 2026) · Microsoft, Configure Windows Hello.