Some systems pop a randomized number pad on password fields to block position-based shoulder surfing

What it is

Banking apps, door locks, and some ATMs draw digit keys in a new permutation for each PIN. A bystander who memorizes finger coordinates cannot map them to digits, because the same coordinates are a different digit next time. The target is position-based shoulder surfing, not fewer symbol-panel switches—an email keyboard putting @ on the home layer is a different purpose. Randomization rebinds keys to digits; the count is still usually 0–9.

Why it happens

A fixed telephone or calculator array lets an observer learn “top-left is 1”; video or a distant eye can reconstruct the PIN. Shuffling the map per session or per key leaves the observer with a spatial trajectory and no legend. Implementations shuffle on each focus and drop the map on dismiss so a leftover screenshot cannot be reused. Randomization does not stop a camera that can read printed digits, a user who speaks the digits, or an attacker using timing rather than position. It also does not stop keyloggers, which read values, not coordinates.

Studying it

Shoulder-surf experiments have a bystander watch from a fixed distance and compare PIN recovery on fixed versus random layouts. Independent variables: whether printed digits are visible to the observer, distance, video replay. Dependent measures: full and partial PIN recovery. Ecologically, separate a person standing beside from a camera that can read print at range. Oversized lab print underestimates how randomization fails against readable legends.

Where it stops holding

Physical desktop numpads cannot reprint legends per session; randomization is almost only on touch. Randomizing a full alphabetic login keyboard destroys touch typing and is rarely used for the main password; short PINs are the usual case. Assistive users who rely on position memory or braille are excluded unless there is an alternative: screen-reader private mode, a hardware keyboard, or audio position. Long pasteable one-time codes do not need a randomized pad.

Applying it

• Use a randomized number pad only for short PINs in shoulder-surf settings (commute, counter).
• Shuffle on every open; digits must be printed so the legitimate user can read them, or even they cannot decode the pad.
• Give screen-reader and switch users a path that does not depend on position, and label the pad as shuffled.
• Verify by letting observers recover a PIN from a video of finger landings only (digits masked): the random group should sit well below the fixed group. Then let them see print, confirming randomization fails in that condition, and do not overclaim the protection.

Related

• Same group: C6.29.2 Password keyboards usually turn off autocorrect and candidates so input is not leaked · C6.29.3 Randomized pads sacrifice touch-typing speed; that is a security–efficiency tradeoff · C6.29.4 Password fields should not use third-party IMEs' cloud candidate services, which can leak plaintext
• Adjacent: C6.23 Numeric keypad layout differences · C6.07 Keyboard types and task fit
• Search: randomized PIN pad · shoulder surfing · scrambled keypad