PIN and Password Authentication

PIN codes and passwords are widely used authentication methods in MyQ deployments – straightforward to set up and familiar to users. Both have security implications that are worth understanding before deciding how to use them.

PIN Codes

A PIN is entered without a username – unlike passwords, the PIN alone is sufficient to authenticate. This makes PIN authentication fast and frictionless, but means the PIN itself carries the full authentication burden. If PINs are too short or predictable, a user may be able to guess another user’s PIN and authenticate as that user. If user storage is connected and folder browsing is enabled, this can also expose stored files.

The security of PINs in your environment is determined by two factors: the number of users and the minimum PIN length. The relationship between them is straightforward. For example, if 10,000 users all use unique 4-digit PINs, there are only 10,000 possible combinations. In that situation, every possible PIN can be assigned to a user, making random guessing far more likely to succeed. Increase the minimum PIN length so that the number of possible combinations significantly exceeds the number of users.

MyQ includes a built-in warning that triggers when the user count approaches the point where PIN uniqueness can no longer be guaranteed. Treat this as a signal to increase the minimum PIN length and regenerate PINs – not something to dismiss.

PINs can be generated by administrators in bulk and distributed to users by email, or users can generate their own if that option is enabled. Consider which model suits your environment: Bulk generation gives administrators central control over PIN generation and distribution. Self-generation reduces administrative overhead, but users must know how to generate or reset their PIN.

PIN authentication is available on embedded terminals, Desktop Client, Mobile Client, and the Print Server Web Interface. It is not available on the Central Server Web Interface, which accepts passwords only.

Temporary PINs

Temporary PINs expire after a defined period and are a useful tool in several specific deployment scenarios. Three use cases are worth planning for explicitly.

Use Temporary PINs for Guest and Visitor Access

Organizations that regularly host external visitors or contractors can configure a fully automated guest printing workflow using temporary PINs and self-registration via Jobs via Email.

When an unrecognized email address sends a print job, MyQ creates an account automatically and assigns it to the SELF-REGISTERED group. If that group is configured to receive only temporary PINs, the new user receives a PIN valid for a defined period – 24 hours is a common choice for day visitors. The PIN expires automatically; the next time the same person visits and sends a job, a new temporary PIN is issued. Regular employees in other groups are unaffected and continue to receive persistent PINs.

When all dependencies are configured correctly, this workflow can create the user account, assign a temporary PIN, and send the PIN by email without routine administrator action. The key configuration dependencies are: self-registration via email enabled, the SELF-REGISTERED group configured for temporary PINs only, and Send PIN via email enabled.

Use Temporary PINs for Organization-Wide PIN Rotation

Some organizations require all users – not just guests – to rotate their PINs regularly. MyQ supports this by generating all PINs as temporary with a defined validity period. For example, you might set a 30-day validity period if your organization requires monthly PIN rotation.

With this configuration, MyQ can generate temporary PINs for new users who meet the PIN-generation conditions, such as having an email address, and send the PIN by email when email notification is enabled. If User can change PIN is enabled, users can generate a new PIN from the Web Interface or Mobile Client before or after expiry. Ensure users are informed about this workflow before it goes live – unexpected PIN expiry at the device is a common source of helpdesk calls.

The following table summarizes the difference in PIN behavior between regular users and users in the SELF-REGISTERED group:

Note that the "User can change PIN" option in User Authentication – PIN applies globally. If disabled, no user – including self-registered guests – can regenerate their own PIN from the Web Interface or Mobile Client.

Use Temporary PINs during ID Card Registration

A short-lived temporary PIN is an effective onboarding tool for environments where ID cards are the primary authentication method. The administrator generates a temporary PIN for the new user – valid for a few days. The user swipes their card at a terminal, is prompted to register it, enters the temporary PIN once to confirm their identity, and the card is linked to their account. After the card is registered, the temporary PIN is no longer needed for regular card authentication and expires according to its validity period. This reduces cleanup compared with issuing persistent PINs for card onboarding.

For this to work, the terminal must be configured with "Allow the existing user to register the card" as the behavior when an unknown card is swiped.

Password Authentication

Passwords are always used in combination with a username – unlike PINs, they cannot authenticate a user on their own. This combination means a correctly guessed password is only useful if the attacker also knows the username, which provides a meaningful additional barrier.

Password authentication is available across all user-facing MyQ components:

• MyQ Web Interface (Print Server and Central Server)

• Embedded Terminals (if enabled in the configuration profile)

• MyQ Desktop Client (if enabled in the configuration profile)

• MyQ X Mobile Client (always available)

At embedded terminals, both the username and password must be entered. Note that an alias can be used in place of the username – useful in environments where the username format is not intuitive for users to type at a device screen.

Users set their own passwords via the Web Interface, subject to the complexity rules configured by the administrator. When defining password rules, consider favoring longer passwords or passphrases over short passwords with complex character requirements. Long passwords are usually easier to make resistant to guessing while remaining usable for users.

If your organization uses Entra ID for user authentication, consider Sign in with Microsoft instead of managing separate MyQ passwords. When users authenticate through Microsoft sign-in, the relevant Entra ID password and MFA policies apply through that identity flow.

Planning Checklist

Before finalizing your PIN and password configuration, confirm the following:

• Minimum PIN length is set so that possible combinations significantly exceed the number of users.

• Send PIN via email is enabled if PINs are the primary or sole authentication method. If this is disabled and new PINs are generated, users receive no email notification. If PIN is their only practical authentication method, they may be unable to use MyQ until an administrator provides or resets their PIN.

• If "User can change PIN" is disabled, users cannot generate a new PIN or reset a forgotten PIN from the Web Interface or Mobile Client. Administrators become the recovery path for PIN issues unless another authentication method is available.

• Temporary PIN validity periods are communicated to affected users before go-live.

• Password complexity policy favors length over character requirements.