How child PINs work

You set a PIN when creating a profile and can change it from the dashboard at any time. PINs are stored hashed rather than in readable form, which means we cannot show you an existing PIN — if you have forgotten one, you reset it rather than look it up.

Requiring the PIN is separate from having one. Each profile has a toggle for whether the PIN must be entered to open that profile. Turning it off means tapping the avatar goes straight into the library, which is usually what you want for a five-year-old who cannot yet type four digits reliably.

A useful middle setting in a mixed-age household is to leave the youngest profile open and require PINs on the older ones. That stops a younger sibling wandering into a library aimed at a ten-year-old, which is the direction that actually matters.

You can also store an optional PIN hint on the profile. The hint is visible only in the parent dashboard, never on the child screen, so it is a note to yourself rather than a clue for your child.

PIN entry is rate limited and failed attempts are tracked per profile. After repeated wrong entries in a short window, the profile locks for a cooling-off period rather than allowing unlimited guessing. This is deliberate: four digits is only ten thousand combinations, and an older sibling with unlimited attempts and a free afternoon is a realistic threat model.

The failed-attempt counter and the lock both clear on a successful entry or when the cooling-off period ends. As the parent, you can reset the PIN from the dashboard at any point, which clears the lock immediately — you are never stuck waiting.

If a profile is locking repeatedly and nobody is trying to break in, that usually means the PIN is too hard for the child it belongs to. Either change it to something more memorable or turn the PIN requirement off for that profile.