Windows Hello, PIN and password: how the three relate

Verified 2026-10-292 min read

Why the PIN is not a weaker password, what happens when you forget it, and which recovery path actually works.

Tested onPro (26H2) · Build 26300.9457 · x64

Build: 26300.9457
Edition: Pro (26H2)
Architecture: x64
Support: Documentation (E1)
Evidence: E1Official documentation
Verified: 2026-10-29
Page type: Concept

The short answer

Three different things that look like “logging in”:

Credential	What it is	Bound to
Password	the account’s real secret	the account (local or online)
PIN	a device-local gesture that unlocks a key	this device + TPM
Hello (face/fingerprint)	biometric unlock of the same key	this device + TPM

The PIN is not a shortened password. It never leaves the device, and it cannot be used on another machine — which is why it is safer than typing your password on a laptop in a café.

Why the PIN is stronger, not weaker

On an MSA machine, the PIN unlocks a key pair protected by the TPM. The password itself is not stored on the device to validate the PIN.

Consequences:

Stealing the disk does not give the PIN.
The PIN is useless on another device.
Resetting the TPM destroys the PIN — and, if BitLocker is on, may trigger recovery.

# TPM state and Hello readiness
Get-Tpm | Select-Object TpmPresent,TpmReady,TpmEnabled,TpmOwned
Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm -ErrorAction SilentlyContinue |
  Select-Object SpecVersion,ManufacturerIdTxt

Forgot the PIN

Situation	Path
MSA machine, other device available	I forgot my PIN → verify via account → set a new PIN
Local account	no PIN recovery: sign in with the password
Password also unknown, local account	reset disk, another admin account, or reinstall
TPM cleared / replaced	PIN is gone; sign in with the password and re-create it

The PIN has no offline recovery on a local account — that is the trade for it being device-bound.

Hello on a machine without a TPM

Windows 11 requires TPM 2.0, so this is mostly a VM question: without a vTPM, Hello PIN and device encryption are unavailable. In a VM, add a virtual TPM rather than disabling the requirement.

# is the device actually capable?
Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm |
  Select-Object IsEnabled_InitialValue,IsActivated_InitialValue,SpecVersion

Multiple users, one device

Each account has its own PIN and its own Hello enrolment. A fingerprint enrolled by user A does not unlock user B — Windows keeps separate credential providers per account.

For shared machines (family, lab), the practical setup is one account per person plus a separate local administrator, not one shared account with a shared PIN.

Lab boundary

E1. Hello/PIN architecture is documented by Microsoft. The lab VMs run a vTPM, which supports Hello in principle, but no biometric hardware exists to enrol.