What Is a PIN (Personal Identification Number)?

The PIN is the oldest and most common way to prove that the person holding a card is its owner. Here is what it is, how it gets checked, and how the payment industry keeps it secret.

What is a PIN?

PIN stands for personal identification number. In simple words: it is the secret code you type on the keypad when you pay in a store or take cash from an ATM. PayPal describes it as "a unique code, usually made up of four to six numbers."9PayPal UK, What is a PIN code?, October 16, 2024 People often say "PIN number" or "PIN code". Both repeat a word, but they mean the same thing.

Visa's definition is more technical: "A personal identification alpha or numeric code that identifies a Cardholder in an Authorization Request originating at a Terminal with electronic capability."1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 The ISO 9564-1 standard allows PINs from 4 to 12 digits and recommends that issuers not assign PINs longer than 6, for usability.8Wikipedia, Personal identification number (summary of ISO 9564-1, read October 14, 2026)

A PIN proves the person. The chip proves the card. Together they make chip and PIN, one of several cardholder verification methods.

How PIN verification works

PIN verification, or PIN authentication, is the check that the typed PIN is correct. EMV chip cards support three methods:5Basin, Sasse, Toro-Pozo, The EMV Standard: Break, Fix, Verify, IEEE S&P 2021

With offline PIN, the chip answers "correct" or "wrong, x tries left". When no tries remain, the card blocks the PIN and refuses every later attempt.5Basin, Sasse, Toro-Pozo, The EMV Standard: Break, Fix, Verify, IEEE S&P 2021 Adyen sums up the encryption rule: "Online PIN is always enciphered (encrypted) while offline PIN can be enciphered or plaintext."6Adyen Docs, Cardholder verification methods (read October 14, 2026)

Visa is pushing plaintext out. New and replacement chip cards that support plaintext offline PIN must also support enciphered offline PIN, and from January 12, 2030 that applies to all such cards (section 4.1.17.2). Unattended terminals must not support plaintext PIN verified offline (section 5.6.1.1, Table 5-8).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

What is a PIN block?

A PIN block is the PIN packed into a fixed-size block before encryption. It mixes the PIN with padding and, in most formats, part of the card number, so the same PIN gives a different encrypted value on each card. ISO 9564 defines the formats:7EFTlab, Complete list of PIN blocks (read October 14, 2026)

So for the search "what is PIN block on debit card": it is not a number on the card. It is the encrypted package that carries your PIN from the PIN pad to whoever checks it.

Inside Tagada

See every payment's route, processor by processor

Set the order your processors are tried in, per store, per country or per product.

See how routing works

Secure PIN processing: PCI PIN and Visa rules

PIN encryption is backed by rules, not only by technology.

• Approved devices. Visa says PINs "must be entered in a device that is validated and approved" under PCI PTS, or FIPS 140-2 or 140-3 level 3 or higher.3Visa, PIN Security (read October 14, 2026) Device rules are on our smart terminal page.
• PCI PIN Security Requirements. The PCI SSC standard is "intended for the secure management, processing, and transmission of personal identification numbers (PINs)." It covers cryptographic keys "throughout their lifecycle" and applies to "Acquiring institutions and agents responsible for PIN transaction processing."2PCI Security Standards Council, PIN Security Standard (read October 14, 2026) Version 3.1 became mandatory for new assessments on October 1, 2021. Visa reported at the time that the deadlines to support PIN block format 4 were "suspended until further notice."4Visa, Updates to PCI PIN Security Requirements and PIN Security Program News, April 1, 2021
• No storage. Merchants and agents must not store "PIN or the encrypted PIN block" after authorization (section 1.9.4.1).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• Penalties. Visa can apply non-compliance assessments for failure to meet the PIN Management Requirements Documents (section 12.5.2.1).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

For card data beyond the PIN, see point-to-point encryption.

"PIN verified" on a receipt

A terminal records which method verified the cardholder. One receipt guide puts it this way: "If the CVM was Pin verified, include confirmation that the PIN was successfully verified." The signature line is printed only when the method was a signature.11PXP Developer Docs, Generate receipts (read October 14, 2026)

Do you need a PIN to pay online?

No. Card PINs are a card-present tool. Online, the issuer checks the buyer through 3D Secure, which EMVCo says helps "prevent card-not-present (CNP) fraud." Higher-risk payments may need "a one-time passcode, knowledge-based questions, biometrics, or other methods."10EMVCo, EMV 3-D Secure (read October 14, 2026) In Europe this is how strong customer authentication is met. For the full picture, see our guide to payment authentication.