# \[Mobile\] Support for alphanumeric PIN codes

**URL:** <https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671>\
**Category:** Password Manager\
**Tags:** app:mobile\
**Created:** [March 21, 2021, 2:04pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671 "2021-03-21T14:04:12Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![kennymc.c](https://avatars.discourse-cdn.com/v4/letter/k/eb9ed0/32.png) [@kennymc.c](https://community.bitwarden.com/u/kennymc.c)\
**Post date:** [March 21, 2021, 2:04pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/1 "2021-03-21T14:04:12Z")

</div>

The mobile app currently only supports numeric pin codes for unlocking. If the smartphone does not have a biometric sensor, a pure numeric code is not very secure if you do not want to enter your master password every time.  
The desktop app and the browser extension already support alphanumeric PIN codes. It would be nice if this could be brought in line with the mobile app.

---

<div class="post-metadata">

**Author:** ![Mark\_C](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/mark_c/32/7879_2.png) [@Mark\_C](https://community.bitwarden.com/u/Mark_C)\
**Post date:** [May 5, 2021, 4:12pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/2 "2021-05-05T16:12:12Z")

</div>

## Feature name

- Allow non-numeric pin (allow password/phrase) on mobile apps.

## Feature function

- The keypad on the Bitwarden android mobile app pulls up a number pad. We do not have the option for using other characters.

- I would like an option in the mobile app to switch from number pad to normal keyboard so we can use a password/passphrase instead of a purely numeric pin.

## Reasoning / Intuition

- People are locking their database, which means it is encrypted with their master decryption key + pin (I assume).
- Their pin basically becomes a _temporary device-held master-password_, while the database is locked.
- If someone has somehow stolen your phone or managed to download the data stored in your device, you want to make sure that the pin is strong.
- This is basically why I want the option of using a password-pin (with word characters) instead of just a pin.

Note: I think would prefer to keep my devices permanently locked, and secured with a pin/password - because typing the master password is less secure than typing a local password. It is more safe if a keylogger or shoulder-surfer obtains a pin, rather than the master password.

Note: Desktop and browser extension do not need to change because they allow any character to input.

This is a very simple feature and would be nice option to have. 🙂

---

<div class="post-metadata">

**Author:** ![rick9004](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rick9004](https://community.bitwarden.com/u/rick9004)\
**Post date:** [January 22, 2023, 2:04pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/3 "2023-01-22T14:04:24Z")

</div>

Bitwarden by using only a numeric keypad is lessening the security on the Android app. Why not open my full keyboard???

I use non numeric key for my open vault on my browser extension. However I cannot use that same key on the Android phone or tablet.

---

<div class="post-metadata">

**Author:** ![OpSec](https://avatars.discourse-cdn.com/v4/letter/o/c89c15/32.png) [@OpSec](https://community.bitwarden.com/u/OpSec)\
**Post date:** [January 23, 2023, 7:09pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/4 "2023-01-23T19:09:58Z")

</div>

I have to admit that would be nice, but I don’t know if its needed. You can set a 8-9 digit PIN and the “bad guy” only gets 5 guesses until you are completely log’d out. Try and guess a 8 digit numeric number in only 5 guesses!!

---

<div class="post-metadata">

**Author:** ![grb](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/grb/32/22038_2.png) [@grb](https://community.bitwarden.com/u/grb)\
**Post date:** [January 23, 2023, 9:00pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/5 "2023-01-23T21:00:43Z")

</div>

> [@OpSec](#):
>
> Try and guess a 8 digit numeric number in only 5 guesses!!

Is it `12345678`? 😜

---

<div class="post-metadata">

**Author:** ![OpSec](https://avatars.discourse-cdn.com/v4/letter/o/c89c15/32.png) [@OpSec](https://community.bitwarden.com/u/OpSec)\
**Post date:** [January 24, 2023, 5:38pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/6 "2023-01-24T17:38:21Z")

</div>

Bryan2023,

I am too lazy to enter 40 characters every single time to access my vault!

---

<div class="post-metadata">

**Author:** ![rick9004](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rick9004](https://community.bitwarden.com/u/rick9004)\
**Post date:** [January 25, 2023, 6:19pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/7 "2023-01-25T18:19:07Z")

</div>

Kinda shocked at the responses considering this an important security product. I thought the idea was to make this as safe as possible not the cavalier answers I got. I’m not going to input my 57 character string of well mixed characters each time I want access.

Enough of that. What I was saying is that BitWarden needs to make their products the same across devices and browsers, as much as possible. BTW, I’m not some newbie, I spent 45+ years building highly complex and secure applications for large banks and law firms where security was number one priority.

---

<div class="post-metadata">

**Author:** ![grb](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/grb/32/22038_2.png) [@grb](https://community.bitwarden.com/u/grb)\
**Post date:** [January 25, 2023, 8:55pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/8 "2023-01-25T20:55:40Z")

</div>

Apologies for my off-topic comment to @OpSec earlier.

I don’t know why the mobile apps only allow numerical PINs, but I have to assume it’s a technical limitation, as Bitwarden strives to be cross-platform compatible as much as possible. I looked through the [original Feature Request for PIN unlock support on non-mobile apps](http://community.bitwarden.com/t/unlock-vault-with-pin/31), but couldn’t find any clues (although I did see that the mobile implementation only allowed [4 digits](http://community.bitwarden.com/t/unlock-vault-with-pin/31/23) at the time). A search through the Github pull requests suggests that [PR #446](https://github.com/bitwarden/mobile/issues/446) may be relevant, although I believe that is just for the keyboard displayed (the restriction to an all-numeric code preceded this PR); you may find additional clues by digging through the Github repos.

FYI, a Feature Request identical to yours was [made in 2021](http://community.bitwarden.com/t/bitwarden-mobile-allow-non-numeric-pin/29638), but apparently did not gain any traction.

Part of the reason for the lack of interest may be that most users consider the threat profile of their mobile device to be sufficiently well-managed that a PIN with 27 bits of entropy should offer sufficient protection against a local attack (especially since it is apparently not clear whether it is even possible to extract the local vault data from a [non-rooted device](http://community.bitwarden.com/t/download-db-from-non-rooted-android-to-recover-lost-master-password/44263/9)), perhaps because they also lock the device itself when not in use.

Those users who are concerned about being able to maintain sufficient operational security to guard their mobile devices still have the option to unlock using their master password instead of a PIN. You are making this option much too difficult for yourself by using a random 57-character string as your master password, which is also atypical for most Bitwarden users. Such a password has 374 bits of entropy, which is overkill. You gain zero security advantage for any password that has more than 256 bits of entropy, and even 256 bits is overkill. All the additional characters only create problems (making it difficult to memorize and type the master password), with no added benefits.

Unless the total value of assets that would be lost if your vault were compromised runs in the billions, a master password providing 65-90 bits of entropy should be sufficient. A randomly generated passphrase containing 5-7 words will provide this level of security, and such passphrases can be memorized and typed out without too much trouble.

---

<div class="post-metadata">

**Author:** ![rick9004](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rick9004](https://community.bitwarden.com/u/rick9004)\
**Post date:** [January 26, 2023, 1:26pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/9 "2023-01-26T13:26:01Z")

</div>

Thank you for a sane rational response to my original question. Yes, my 57 character key may be overkill, but since I’m not an expert on crypto it was my choice of out naivety. I still would like conformity across platforms if possible. Bitwarden is a great product and only wish I had it back in the early days of the Internet when passwords were short or non-existing for some sites.

---

<div class="post-metadata">

**Author:** ![mu88](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/mu88/32/31226_2.png) [@mu88](https://community.bitwarden.com/u/mu88)\
**Post date:** [January 4, 2025, 3:43pm UTC](https://community.bitwarden.com/t/mobile-support-for-alphanumeric-pin-codes/27671/10 "2025-01-04T15:43:02Z")

</div>

is there any news about this issue?
