# Windows Hello, PIN and password: how the three relate

> Why the PIN is not a weaker password, what happens when you forget it, and which recovery path actually works.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Three different things that look like "logging in":

| Credential | What it is | Bound to |
|---|---|---|
| **Password** | the account's real secret | the account (local or online) |
| **PIN** | a device-local gesture that unlocks a key | **this device + TPM** |
| **Hello (face/fingerprint)** | biometric unlock of the same key | **this device + TPM** |

The PIN is **not** a shortened password. It never leaves the device, and it cannot be used on another machine — which is why it is safer than typing your password on a laptop in a café.

## Why the PIN is stronger, not weaker

On an MSA machine, the PIN unlocks a key pair protected by the TPM. The password itself is not stored on the device to validate the PIN.

Consequences:

- Stealing the disk does not give the PIN.
- The PIN is useless on another device.
- Resetting the TPM destroys the PIN — and, if BitLocker is on, may trigger recovery.

```powershell
# TPM state and Hello readiness
Get-Tpm | Select-Object TpmPresent,TpmReady,TpmEnabled,TpmOwned
Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm -ErrorAction SilentlyContinue |
  Select-Object SpecVersion,ManufacturerIdTxt
```

## Forgot the PIN

| Situation | Path |
|---|---|
| MSA machine, other device available | **I forgot my PIN** → verify via account → set a new PIN |
| Local account | no PIN recovery: sign in with the password |
| Password also unknown, local account | reset disk, another admin account, or reinstall |
| TPM cleared / replaced | PIN is gone; sign in with the password and re-create it |

The PIN has **no offline recovery** on a local account — that is the trade for it being device-bound.

> **Caution: Clearing the TPM is not a troubleshooting step**
>
> Clearing or resetting the TPM discards the keys stored there: the Hello PIN, and the BitLocker key protectors. If BitLocker is on and the recovery key is not in hand, the data is gone. Suspend BitLocker and export the key first — see the [recovery drill](https://windows.homes/en/windows/hardening/bitlocker-recovery-drill/).

## Hello on a machine without a TPM

Windows 11 requires TPM 2.0, so this is mostly a VM question: without a vTPM, Hello PIN and device encryption are unavailable. In a VM, add a **virtual TPM** rather than disabling the requirement.

```powershell
# is the device actually capable?
Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm |
  Select-Object IsEnabled_InitialValue,IsActivated_InitialValue,SpecVersion
```

## Multiple users, one device

Each account has its own PIN and its own Hello enrolment. A fingerprint enrolled by user A does not unlock user B — Windows keeps separate credential providers per account.

For shared machines (family, lab), the practical setup is one account per person plus a separate local administrator, not one shared account with a shared PIN.

## Related

- [Local account or Microsoft account](https://windows.homes/en/windows/account/local-vs-msa/)
- [A corrupt profile](https://windows.homes/en/windows/account/profile-corruption/)
- [BitLocker recovery drill](https://windows.homes/en/windows/hardening/bitlocker-recovery-drill/)

## Lab boundary

E1. Hello/PIN architecture is documented by Microsoft. The lab VMs run a vTPM, which supports Hello in principle, but no biometric hardware exists to enrol.

## Sources

- [Microsoft Learn — Windows Hello for Business](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/)
- [Microsoft Learn — TPM fundamentals](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals)
- [Microsoft Learn — Accounts CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/accounts-csp)

---

Source: https://windows.homes/en/windows/account/hello-pin/