Remove the PIN in Windows 11 and 10 (and Fix the Grayed-Out Remove Button)

To remove your PIN in Windows 11, open Settings, go to Accounts and then Sign-in options, expand PIN (Windows Hello), and select Remove. Confirm with your account password. If Remove is grayed out, the usual cause is the switch further down the same page, For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device. Turn it off, close and reopen Settings, and Remove becomes available. Remove fingerprint and face sign-in first if you set them up, since they depend on the PIN. On work or school PCs, a policy may require the PIN, and only IT can change that. Once the PIN is removed, you sign in with your account password. To sign in with nothing at all, see automatic sign-in.

Ethan's mother never liked her new laptop's PIN. She had used the same password for her Microsoft account for years and kept typing it into the PIN box, getting it wrong and locking herself out. Ethan tried to remove the PIN, found the Remove button grayed out, and called Jake. The fix took a minute. The "only allow Windows Hello sign-in" switch was on, as it is on many new PCs; Jake turned it off, reopened Settings, and Remove worked. Before removing the PIN, though, he explained the trade-off. The PIN only works on that laptop, while her Microsoft account password works everywhere, so typing the password on the sign-in screen exposes something more valuable. They agreed on a compromise: a longer, easy-to-remember PIN instead of the old four digits. This page shows how to remove the PIN in Windows 11 and 10, every reason Remove is grayed out, the command-line and policy methods, what changes afterward, and when keeping a PIN is the better choice.

What the Windows PIN is, and why Windows pushes it

The Windows Hello PIN is a code that signs you in to one specific PC. Unlike your Microsoft account password, which works on any device and any website where you use that account, the PIN is tied to the PC's security chip, the TPM, and is useless anywhere else. Someone who learns your PIN cannot sign in to your email, OneDrive or Microsoft account from another device with it, while someone who learns your password can.

That is why Windows asks you to create a PIN during setup on new PCs, and why it nudges you to keep one. The PIN also underpins the rest of Windows Hello: fingerprint and face sign-in require a PIN as their fallback, and passkeys, the password replacements many websites now use, are unlocked with Windows Hello. Our guide to what Windows Hello is covers the full picture.

Despite all that, people have good reasons to remove a PIN: they find two codes confusing, as Ethan's mother did; they share a family PC and want one familiar password; they are troubleshooting a broken PIN; they plan to use automatic sign-in; or they are switching to a local account. Removing it is supported, as long as you understand what changes.

PIN, password and biometrics compared

The table shows why Microsoft treats the PIN as the safer everyday sign-in, and why removing it means relying on a credential that protects much more than one PC.

Remove the PIN in Windows 11

1. Open Settings with Windows + I.
2. Select Accounts, then Sign-in options.
3. If Facial recognition or Fingerprint recognition is set up, expand each and select Remove first.
4. Scroll down to Additional settings and turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device, if it is on.
5. Close Settings completely and open it again, then return to Accounts, Sign-in options.
6. Expand PIN (Windows Hello) and select Remove, then Remove again to confirm.
7. Enter your account password when asked, and select OK.

The PIN is deleted, and the next time you sign in, Windows asks for your password. If you use a Microsoft account, that is your Microsoft account password; with a local account, it is the local password. If your local account has no password, removing the PIN means Windows signs in without asking for anything at all, which is convenient but leaves the PC open to anyone who picks it up.

Reopening Settings in step 5 matters: the Remove button often stays grayed out until the page is reloaded after turning off the Windows Hello-only switch. That one detail is behind many reports that the switch "does not work".

Check which sign-in methods you have

Before removing anything, it helps to see what is set up. Settings, Accounts, Sign-in options lists every method: Facial recognition, Fingerprint recognition, PIN, Security key and Password, each saying whether it is set up. The Additional settings section below shows the Windows Hello-only switch, dynamic lock, and when Windows requires sign-in after you have been away.

Also check which type of account you use, in Settings, Accounts, Your info: Microsoft account shows your email address, and Local account says so. That decides which password you will use after removing the PIN, and whether the passwordless account question applies. A minute here avoids the surprise of removing a PIN and then not knowing which password Windows wants.

Remove the PIN in Windows 10

In Windows 10, open Settings, Accounts, Sign-in options. Select Windows Hello PIN to expand it, and select Remove, then confirm and enter your password. On newer Windows 10 versions, the Windows Hello-only switch, called Require Windows Hello sign-in for Microsoft accounts, appears near the top of the page, and must be off for Remove to work.

Older Windows 10 versions show the PIN in its own section with Change, Remove and I forgot my PIN links. The steps are the same. Windows 10 is past its October 2025 end of support except for PCs enrolled in Extended Security Updates, and a PIN on an unpatched PC is still safer than a password typed at every sign-in, which is worth weighing before removing it.

Why the Remove button is grayed out: every cause

The first cause covers most cases. Microsoft turns the Windows Hello-only switch on by default for many new PCs with Microsoft accounts, to encourage passwordless sign-in, and while it is on, Windows will not let you remove the PIN, since that would leave no permitted way to sign in.

The passwordless account case is newer. If you turned on the passwordless option for your Microsoft account, at account.microsoft.com, Security, Advanced security options, the account has no password at all, so Windows cannot fall back to one. Turn passwordless off there, which asks you to create a password, before removing the PIN; alternatively, keep the PIN, which is the point of a passwordless account.

A quick way to diagnose which cause applies is to read the page from top to bottom. If fingerprint or face show Remove buttons, start there. If the Windows Hello-only switch is on, turn it off. If a banner at the top says some settings are managed by your organization, it is a policy, and the rest of the list does not matter. If none of those apply and Remove is still gray after reopening Settings and signing out and back in, the PIN data is likely damaged, and the reset section below is the next step.

Fingerprint and face depend on the PIN

Windows Hello's fingerprint and face recognition require a PIN as their backup, for times when the sensor cannot recognize you. As long as either is set up, Windows keeps the PIN, and the Remove button may be unavailable or removal may fail. Remove fingerprint and face in Sign-in options first, then the PIN.

If what you really want is to stop biometric sign-in rather than the PIN, you do not need to remove the PIN at all; our guide to turning off fingerprint and face sign-in covers that, including disabling biometrics for every user.

The order matters in reverse too. If you later want fingerprint or face sign-in again, Windows asks you to set up a PIN first, then the biometric method. Keeping a PIN, even one you rarely type, keeps that door open and gives you a fallback when the sensor is having a bad day, such as with cold or wet fingers or poor lighting for the camera.

Remove all PIN data when the PIN is broken

If the PIN is damaged, with errors such as "Something happened and your PIN isn't available" or a Remove button that fails, Windows' PIN data can be reset completely. The data lives in a protected folder, C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc, and deleting its contents removes the PINs of all users on the PC, after which each person can sign in with a password and set up a new PIN if they want one.

Accessing that folder requires taking ownership of it as an administrator, which is a delicate operation; our guide to "Your PIN isn't available" walks through it safely, and our Windows Hello PIN guide covers resetting a forgotten PIN from the sign-in screen, which is easier when that is all you need.

For the current user only, the command certutil -DeleteHelloContainer, run in a normal Command Prompt and followed by signing out, deletes that user's Windows Hello container, including the PIN. It is mainly used with Windows Hello for Business on work PCs, but it can clear a stuck PIN for one account without touching the Ngc folder. Make sure you know your account password before running it.

Removing another user's PIN

Each person's PIN belongs to their own account, and Windows does not let one user remove another's PIN through Settings, even an administrator. The simplest way is for that person to sign in and remove it themselves. If they cannot sign in because they forgot the PIN, they can use I forgot my PIN on the sign-in screen, or sign in with their password through Sign-in options.

An administrator can reset every user's PIN at once by clearing the Ngc folder, as described above, which forces each user to sign in with their password next time. That is a heavy tool, best kept for broken PINs rather than routine changes. For a local account whose owner has forgotten both PIN and password, an administrator can reset the local password in Computer Management or with net user, after which the person signs in with the new password.

Remove fails with an error

Occasionally Remove is available but fails, with a message such as "Something went wrong" or an error code like 0x80090016, or the PIN appears again after a restart. These point to damaged Windows Hello data or a problem with the TPM. Work through these steps: restart and try again; make sure Windows is fully updated; check that the TPM is working with tpm.msc, which should report that the TPM is ready for use; then reset the PIN data as described above, or with certutil for the current user.

If the PC's firmware was updated or the TPM was cleared recently, Windows Hello data tied to the old TPM state becomes unusable, which also causes these errors. Resetting the PIN data and setting up a new PIN, or removing it, fixes it. Our guide to PIN errors covers each code.

Work and school PCs: PIN required by policy

On PCs joined to an organization, through Microsoft Entra ID, a domain or device management, the PIN is usually part of Windows Hello for Business, and policies can require it. In that case, Sign-in options shows that some settings are managed by your organization, and Remove is unavailable by design. Only IT can change it, and they usually will not, since the PIN is part of the organization's security model.

If a work PIN is causing problems, such as frequent lockouts or a forgotten PIN, use the reset option on the sign-in screen or contact IT. Do not try policy or registry changes on a managed PC; they are likely to be reversed and may break compliance checks that control your access to work resources.

On domain-joined PCs, administrators can also allow or block PIN sign-in for domain users with the Group Policy Turn on convenience PIN sign-in, under Computer Configuration, Administrative Templates, System, Logon; disabling it removes the PIN option for domain accounts. That policy does not apply to personal Microsoft or local accounts.

PIN complexity rules

Windows lets administrators set PIN rules: minimum and maximum length, whether letters, symbols or digits are required, and expiration. On Windows Pro, these are in Group Policy under Computer Configuration, Administrative Templates, System, PIN Complexity, and organizations set them through Intune for Windows Hello for Business. On a home PC, they are not set unless someone configured them.

If Windows rejects a new PIN as not meeting requirements, one of these rules is in effect, and the message usually says what is needed. On a family PC where an older tweak or a previous work setup left such rules behind, setting the PIN Complexity policies back to Not Configured removes them.

What changes after you remove the PIN

Signing in. You type your account password at the sign-in screen. For a Microsoft account, that is the same password you use for Outlook.com and OneDrive, so choose a strong one and be mindful of people watching you type.

Passkeys and Windows Hello prompts. Websites and apps that ask for Windows Hello confirmation will ask for your password or fail, and passkeys stored on the PC may become unusable, since they are protected by Windows Hello. If you rely on passkeys saved on the PC, keep the PIN or move them to your phone or a password manager first.

Password managers and apps. Apps that unlock with Windows Hello, such as some password managers and banking apps, fall back to their own master password or stop offering Windows Hello unlock.

Biometrics. Fingerprint and face sign-in are gone, since they need the PIN.

Remote Desktop and network access. Nothing changes; those always use the account password.

If you change your mind, add a PIN again at any time from Sign-in options, PIN, Set up.

The PIN after a reset or a new PC

PINs never move between PCs. Each PC has its own, tied to its own security chip, so a new PC, a reset or a reinstalled Windows asks you to set up a PIN again, and removing the PIN on one PC has no effect on others. The same is true of fingerprint and face enrollments. Your Microsoft account password, by contrast, is the same everywhere.

If you removed the PIN on an old PC because it confused someone, consider choosing the same, easy-to-remember PIN on the new PC rather than removing it again; the confusion usually came from having two different codes, not from the PIN itself.

Protect your Microsoft account if you remove the PIN

Removing the PIN puts your Microsoft account password back on the sign-in screen, so it is a good moment to strengthen the account itself. Turn on two-step verification at account.microsoft.com, Security, which asks for a second check, such as the Microsoft Authenticator app or a code, when you sign in on a new device. Use a password you do not use anywhere else, and keep the account's recovery email and phone number current.

Two-step verification does not add a step to signing in on your own PC, where Windows remembers the device, but it stops someone who learns your password from using it elsewhere. With the PIN gone, it is the main defense for everything your account protects, from email to OneDrive files and saved passwords in Edge. Our guide to Microsoft account alerts covers keeping security information up to date.

Locking settings to pair with a password

Without a PIN, you will type your password more often, which tempts people to make Windows ask less. The settings that control that are in Sign-in options, Additional settings. If you've been away, when should Windows require you to sign in again? can be set to Every time, or to a delay after the PC wakes; Every time is safest. Dynamic lock locks the PC automatically shortly after your paired phone moves out of Bluetooth range, which protects a PC you forget to lock when you walk away.

Combined with a screen timeout in Power settings, these keep the PC protected without demanding the password constantly while you are at it. Pressing Windows + L when you leave remains the simplest habit of all.

Security keys as an alternative

A security key, a small USB or NFC device that follows the FIDO2 standard, can be used to sign in to Microsoft accounts and many websites without a password, and on work PCs, to sign in to Windows itself. For personal PCs, security keys are mostly used for account sign-in on the web and for two-step verification, rather than as a replacement for the Windows PIN at the sign-in screen.

If you want strong protection for your Microsoft account without relying on typing a password, adding a security key or the Authenticator app as a sign-in method at account.microsoft.com is a good complement to removing the PIN. Set up a security key in Settings, Accounts, Sign-in options, Security key, where Windows also lets you manage its PIN.

Should you remove your PIN?

For most people, a PIN is both safer and easier than a password, and keeping it is the better choice. It is tied to the device, so it cannot be used elsewhere if someone sees it; Windows locks it after repeated wrong attempts, stopping guessing; and it can be long, including letters and symbols if you check the option, so it can be as strong as you like. Typing your Microsoft account password at every sign-in, on the other hand, exposes the key to your email and files to anyone watching.

Removing the PIN makes sense mainly when the PIN itself causes real problems: confusion for a less confident user, a shared PC where the family prefers one password, a broken PIN you plan to set up again, or when you are switching to automatic sign-in on a PC that never leaves the house. For Ethan's mother, a longer PIN that she could remember, rather than no PIN, solved the confusion without giving up the security.

If you do remove it, protect the PC in other ways: a strong account password, the screen locking automatically when you step away, and Windows' account lockout settings to slow down anyone guessing; our guide to account lockout policy covers those.

Why Microsoft is moving away from passwords

The push to keep a PIN is part of a broader shift. Microsoft, Apple and Google are moving accounts toward passwordless sign-in, using device-bound credentials such as Windows Hello and passkeys instead of passwords, because passwords are the main way accounts get stolen: they are reused, guessed, and typed into fake sign-in pages. A PIN or fingerprint on a specific device cannot be phished that way.

That is why new PCs turn on the Windows Hello-only switch, why setup asks for a PIN, and why Microsoft accounts can now remove their passwords entirely. None of it stops you from removing the PIN on your own PC, but it explains the friction, and why the direction of travel is toward more Windows Hello, not less. If you keep the PIN, you are aligned with where account security is going; if you remove it, compensate with a strong password and two-step verification.

PIN myths

Myth: a four-digit PIN is weaker than a password. For signing in to one PC, it is often stronger in practice, because it is useless without the device and Windows locks it after a few guesses, while a password can be tried from anywhere. Longer PINs are stronger still. Myth: the PIN is stored with Microsoft. The PIN never leaves the PC; it unlocks a key in the device's security chip. Myth: removing the PIN is unsupported. It is supported, with the conditions on this page.

Myth: you cannot remove the PIN on Windows 11. You can; the grayed-out button is a matter of settings, not a hard rule, except on managed work PCs. Myth: removing the PIN speeds up sign-in. Typing a password is usually slower than a PIN. Knowing these makes the decision clearer: remove the PIN when it causes real problems, not because of a misunderstanding.

A stronger PIN instead of no PIN

If the problem is that the PIN is too short to feel secure, or too easy for others to guess, change it rather than removing it. A PIN can be long and can include letters and symbols, which makes it effectively a device-only password.

1. Open Settings, Accounts, Sign-in options.
2. Expand PIN (Windows Hello) and select Change PIN.
3. Enter your current PIN.
4. Check Include letters and symbols if you want a mixed PIN.
5. Enter the new PIN twice. Six digits or more is a good minimum; a short phrase is even better if you check the letters option.
6. Select OK.

A longer PIN keeps all the advantages of Windows Hello, works with passkeys and biometrics, and is still tied to the one PC. For Ethan's mother, a six-digit number she already knew by heart, not her old password, ended the confusion between the two codes.

PIN lockout and the A1B2C3 prompt

The PIN is protected against guessing by the PC's security chip. After several wrong attempts, Windows makes you wait before trying again, with the wait growing after more failures. Eventually it may ask you to type a challenge phrase, A1B2C3, shown on the screen, to prove a person is at the keyboard, or to restart the PC before more attempts are allowed. That is normal anti-hammering protection, not a fault.

If you have forgotten the PIN, stop guessing and select I forgot my PIN below the PIN box, which verifies your Microsoft account and lets you set a new PIN. For a local account, sign-in options on the screen may let you use your password instead; select Sign-in options under the PIN box and choose the key icon.

The BitLocker startup PIN is a different thing

People sometimes confuse the Windows Hello PIN with a BitLocker startup PIN. The BitLocker PIN, set up by some organizations and security-conscious users, is entered before Windows starts, on a blue or black pre-boot screen, to unlock the encrypted drive. The Windows Hello PIN is entered on the normal sign-in screen, after Windows has started, to sign in to your account.

Removing the Windows Hello PIN in Sign-in options does not affect a BitLocker startup PIN, and vice versa. A BitLocker startup PIN is managed through Manage BitLocker in Control Panel or by IT. If you see a PIN prompt before the Windows logo, that is BitLocker, and this page's steps do not apply to it.

Sign in with no PIN or password at all

Some people remove the PIN because they want Windows to sign in automatically, with no code at all, on a home PC. Removing the PIN is the first step, but automatic sign-in needs its own setting, which Windows hides when the Windows Hello-only switch is on. Our guide to automatic sign-in walks through the netplwiz check box and the Sysinternals Autologon tool.

Automatic sign-in is only sensible for PCs that never leave a secure home and are not used for sensitive work. It also means anyone who turns the PC on is signed in as you, with access to your email, files and saved passwords in browsers. For laptops, it is a poor trade.

Skipping the PIN during Windows setup

New Windows 11 PCs set up with a Microsoft account usually ask you to create a PIN as part of setup, and the screen may not offer an obvious skip. Creating the PIN and removing it afterward, with the steps on this page, is the straightforward approach. Setting up the PC with a local account, where your edition and setup options allow, avoids the prompt, but has its own trade-offs for syncing and Microsoft services.

Later prompts to set up Windows Hello, which appear after updates or in notifications, can be dismissed. If they return frequently, it is usually because the Windows Hello-only switch is on or a policy expects a PIN; turning the switch off reduces the nagging.

Helping an older relative with sign-in

Sign-in confusion is one of the most common support calls in families, and the PIN is often at the center of it, because people mix up the PIN and the password. A few choices help. Pick one code the person will remember and make it the PIN, rather than introducing a new code; write it somewhere safe at home, away from the PC. Set the sign-in screen to show the PIN box by default, which Windows does when a PIN exists. And remove fingerprint or face only if they cause confusion, since many older users find a fingerprint easiest of all.

If the person never leaves the house with the PC and lives alone, automatic sign-in might be acceptable; otherwise, a simple PIN is the best balance. Ethan's mother now uses her six-digit PIN and the fingerprint reader, and her Microsoft account password stays safely in a notebook in a drawer.

One password for the whole family?

Some families share one Windows account on one PC with one password, and remove the PIN so that everyone uses the same familiar code. It works, but it means everyone shares one email, one set of saved passwords and one browser history. Giving each person their own account, each with a simple PIN, is usually better: everyone has their own desktop and files, and a child cannot accidentally open a parent's email.

Separate accounts also make PINs less confusing, since each person only has to remember their own. For young children, a family-managed Microsoft account adds parental controls, with the child's PIN set by the child and known to the parent if needed.

Shared office and demo PCs

Shared PCs in small offices, shops and classrooms raise their own questions. A PC that several people use with one shared account and PIN is convenient but means everyone shares one identity, which makes it impossible to know who did what. Separate accounts, each with its own PIN, are better for accountability, and Windows' fast user switching makes changing users quick.

For demo or kiosk PCs that should simply run one app, Windows' kiosk features, set up in Settings, Accounts, Other users, Kiosk on supported editions, or by IT, are designed for that and avoid the need for anyone to sign in at all. Removing the PIN on an ordinary account to achieve the same effect leaves more of the PC open than a proper kiosk setup does.

Switching to a local account

Another route people take is switching from a Microsoft account to a local account, which has its own password, or none. In Settings, Accounts, Your info, select Sign in with a local account instead where offered, and follow the steps; Windows asks for your current PIN or password, then a new local user name and password. After switching, Windows Hello PIN can be removed or set up again for the local account.

Switching affects syncing of settings, OneDrive sign-in and Microsoft Store apps, which you can sign into separately. Our guide to creating local and Microsoft accounts explains the differences.

Switching back to a Microsoft account later is just as easy, from the same page, with Sign in with a Microsoft account instead. Your files and apps stay where they are in both directions; only the way you sign in, and what syncs, changes. Many people find a local account with a short, memorable password and no PIN the simplest setup for a PC that stays at home, while keeping their Microsoft account for email and OneDrive in the browser.

Frequently asked questions

Removing a Windows PIN takes a minute once you know the catch: the Windows Hello-only switch must be off, Settings must be reopened, and fingerprint and face must go first. Work PCs keep the PIN by policy, broken PINs can be reset, and afterward you sign in with your password. Before removing it, weigh the trade-off, since a PIN that only works on one PC is often safer than a password that unlocks your whole account. Ethan's mother kept a longer PIN in the end, and has not been locked out since.

Revision note. Written October 3, 2026, expanding our 2015 guide to removing the PIN into a complete guide for Windows 11 and 10. It covers what the PIN is, removal steps, every cause of a grayed-out Remove button, biometrics, resetting PIN data, work PCs and policies, what changes afterward, whether to remove it, automatic sign-in and local accounts. May you never be locked out of your own PC.