How to manage kiosk PINs

How to manage kiosk PINs#

For: Manager (for resets); Shift worker (for self-change) You’ll need: The employee whose PIN you want to manage.

Each employee has a personal 4-digit PIN stored on their Shiftavo membership. It’s used only at the kiosk — not for the regular login. Three ways a PIN gets set or changed:

Auto-assigned on invite#

When you create a new person (under Company → People), Shiftavo generates a fresh 4-digit PIN for them automatically. The plaintext PIN is flashed once in a toast message after the person is created — it’s gone as soon as the toast disappears.

Warning

Hand the PIN over in person, on paper, or via a secure channel. Shiftavo cannot show it again — the next time you (or anyone) needs it, it has to be reset.

Self-change by the employee#

The employee changes their own PIN from the account dropdown (top-right) under ‘Settings’ → ‘Change PIN’ (or the /kiosk/pin/change/ URL):

  1. ‘Current PIN’ — what they have now. Leave blank if they’ve never had one.

  2. ‘New PIN’ — four digits.

  3. ‘Confirm new PIN’ — the same four digits.

If they get the current PIN wrong too many times, the form is rate-limited for 15 minutes.

Manager reset#

When an employee forgets or loses their PIN, a manager resets it.

  1. In the sidebar, go to Company → People.

  2. Open the person.

  3. Click ‘Reset kiosk PIN’.

  4. The new plaintext PIN is shown once. Hand it over the same way as the initial PIN.

Note

Resetting overwrites the old PIN — there is no “see the existing PIN” option. Hashed PINs are stored one-way; even the database can’t show plaintext.

Why 4 digits?#

A trade-off. Longer PINs are slow to type on a busy floor; shorter PINs are too easy to guess. Four digits with rate-limiting (5 wrong tries / 15 min) gives an attacker effectively no chance to brute-force, while still being fast for the worker. If you need stronger guarantees for a specific role, don’t give that person a kiosk PIN — they can clock in via the normal timesheet UI from a personal device.

Verify it worked#

The person can clock in at the tablet with the new PIN. Five wrong attempts inside 15 minutes lock that person out for 15 minutes — which is also how you know the rate limit is live.