Question

I want to create a PIN that is unique within a table but not incremental to make it harder for people to guess.
Ideally I’d like to be able to create this within SQL Server but I can do it via ASP.Net if needed.

EDIT

Sorry if I wasn’t clear: I’m not looking for a GUID as all I need is a unique id for that table; I just don’t want it to be incremental.

Answer 1

Add a uniqueidentifier column to your table, with a default value of NEWID(). This will ensure that each column gets a new unique identifier, which is not incremental.

CREATE TABLE MyTable (
   ...
   PIN uniqueidentifier NOT NULL DEFAULT newid()
   ...
)

The uniqueidentifier is guaranteed to be unique, not just for this table, but for all tables.

If it’s too large for your application, you can derive a smaller PIN from this number, you can do this like:

   SELECT RIGHT(REPLACE((SELECT PIN from MyTable WHERE UserID=...), '-', ''), 4/*PinLength*/)

Note that the returned smaller PIN is not guaranteed to be unique for all users, but may be more manageable, depending upon your application.

EDIT: If you want a small PIN, with guaranteed uniqueness, the tricky part is that you need to know at least the maximum number of users, in order to choose the appropriate size of the pin. As the number of users increases, the chances of a PIN collision increases. This is similar to the Coupon Collector’s problem, and approaches n log n complexity, which will cause very slow inserts (insert time proportional to the number of existing elements, so inserting M items then becomes O(N^2)). The simplest way to avoid this is to use a large unique ID, and select only a portion of that for your PIN, assuming that you can forgo uniqueness of PIN values.

EDIT2:

If you have a table definition like this

CREATE TABLE YourTable (
    [id] [int] IDENTITY(1,1) NOT NULL,
    [pin]  AS (CONVERT(varchar(9),id,0)+RIGHT(pinseed,3)) PERSISTED,
    [pinseed] [uniqueidentifier] NOT NULL
)

This will create the pin from the pinseed a unique ID and the row id. (RAND does not work – since SQL server will use the same value to initialize multiple rows, this is not the case with NEWID())

Just so that it is said, I advise that you do not consider this in any way secure. You should consider it always possible that another user could guess someone else’s PIN, unless you somehow limit the number of allowed guesses (e.g. stop accepting requests after 3 attempts, similar to a bank witholding your card after 3 incorrect PIN entries.)