What you will achieve
Set up Windows Hello PIN sign-in on Windows 11 or 10 — faster than typing a long password, tied to your device and optionally protected by TPM hardware.
1) Check prerequisites
- You need a password or Microsoft account sign-in before adding a PIN.
- For best security, confirm TPM is present: Settings → Privacy & security → Windows Security → Device security → Security processor.
- On domain-joined PCs, IT policy may block PIN — check with admin first.
2) Add a PIN in Settings
- Open Settings → Accounts → Sign-in options.
- Under PIN (Windows Hello), click Set up (or Add).
- Confirm your account password when prompted.
- Enter a PIN (minimum four digits; alphanumeric PINs are supported — enable in the same screen).
- Confirm the PIN and finish.
Sign out and sign back in using the PIN to verify it works at the lock screen.
3) Enable stronger PIN options
On the same Sign-in options page:
- Turn on Include letters and symbols for a longer, harder-to-guess PIN.
- Enable For improved security, allow Windows Hello to use enhanced sign-in security when offered — requires TPM 2.0.
4) Change or remove the PIN
- Return to Settings → Accounts → Sign-in options → PIN (Windows Hello).
- Click Change PIN to update it, or Remove to disable PIN sign-in.
- Removing the PIN does not delete your password — you will sign in with password instead.
5) Recover if you forget the PIN
At the sign-in screen, click Sign-in options → Password and use your Microsoft or local account password. After signing in, set a new PIN in Settings. If you forgot both PIN and password on a Microsoft account, use account recovery at account.microsoft.com from another device.
6) PIN vs password — when to use each
A Windows Hello PIN is tied to the device TPM when enhanced security is on — stealing the PIN file off disk does not grant access on another PC. Passwords travel with your account. Use PIN for daily sign-in on trusted hardware; keep a strong account password for recovery and remote sign-in. Disable Only allow Windows Hello sign-in for Microsoft accounts on this device in Sign-in options if you need password fallback at every boot.