Something went wrong, says Windows, about a PIN you have used for a year. Or the PIN box is simply gone. Panic is understandable and unnecessary: the PIN is a device-local key with its own rules, its own failure modes, and — most importantly — its own spare door. Your account and your files were never locked; only this one key stopped turning.
First, the fact that explains every PIN mystery: your PIN is not a short password. A password belongs to your account and is checked against Microsoft or the PC's account list. A PIN belongs to this device only — it is created here, stored here, guarded by this PC's TPM chip, and it means nothing on any other machine. When a PIN "suddenly" stops working, it is almost always the device side of that bargain that changed.
Under the PIN box sits Sign-in options. Choose the password icon and sign in with the account password instead. The PIN being broken does not lock the account — it breaks one key, not the house. Nine times out of ten you are now at your desktop, and the PIN becomes a five-minute settings job instead of a lockout. If the password is also refused, that is the password family — its own guide in this series takes it from there.
On the sign-in screen, click I forgot my PIN. Windows will ask for the account password and, for a Microsoft account, an internet connection, then let you set a brand-new PIN on the spot. Two honest notes: this route does not exist without the password — the PIN reset is protected by the password, which is exactly how it should be — and on an office PC the same flow may be blocked by policy, in which case IT resets it for you.
If your PIN died right after a motherboard repair, a TPM clear, a BIOS update or a Secure Boot change, nothing is haunted — the PIN was sealed to the old hardware state, and the seal no longer matches. Windows is doing its job. Sign in with the password (Fix 1), then go to Settings → Accounts → Sign-in options → PIN, remove the old PIN and create a fresh one against the new hardware state. The same applies to fingerprint and face sign-in after such changes: set them up again, do not troubleshoot them as if they were broken software.
Rarely, the PIN option vanishes from the sign-in screen entirely, or every PIN attempt errors even after a reset. The store behind it — a protected folder named Ngc — can corrupt. Deleting its contents forces Windows to build a clean one:
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc — you will need to take ownership of the folder, as Windows guards it for good reason.Be clear-eyed about the cost: this clears Windows Hello for every account on the PC, so housemates' PINs and fingerprints go with it. That is why it is Fix 4 and not Fix 1 — try the two supported doors above first.
Watch the video to see the locked-out routine done right — get in by a working door, fix the broken one, and only then call it repaired.
▶️ Watch Full VideoIn one specific way, yes. A stolen password can be typed into any computer on earth; a stolen PIN is useless anywhere except on the device it was created on, because it never travels and is guarded by that PC's TPM chip with anti-hammering limits. That device-binding is exactly why the PIN breaks when the hardware state changes — the safety and the fragility are the same feature.
Usually because the update touched something the PIN's seal depends on — firmware, TPM state, Secure Boot. Windows then asks you to confirm or recreate the PIN against the new state. It is mildly annoying and genuinely by design: the alternative, a PIN that ignores hardware changes, would protect far less.
No — the account is fine, which you can prove by signing in with the password through Sign-in options. A missing PIN option usually means a corrupted PIN store (Fix 4 rebuilds it) or, on work PCs, a policy that turned Windows Hello off. On a personal PC, the rebuild route restores the option; on an office PC, that absence is a message from IT, not a fault.