diff --git a/src/wscutil.c b/src/wscutil.c
index 3060e418..d8c29e8d 100644
--- a/src/wscutil.c
+++ b/src/wscutil.c
@@ -27,6 +27,7 @@
 #include <stdbool.h>
 #include <stdarg.h>
 #include <errno.h>
+#include <stdio.h>
 
 #include <ell/ell.h>
 
@@ -2559,3 +2560,23 @@ bool wsc_pin_is_checksum_valid(const char *pin)
 	char digit = compute_check_digit(pin);
 	return pin[7] == digit;
 }
+
+/*
+ * Generate an 8 character PIN string into buffer given by @pin.  @pin must be
+ * at least 9 bytes long to account for the nul character.
+ */
+bool wsc_pin_generate(char *pin)
+{
+	uint32_t random;
+	bool ok;
+
+	ok = l_getrandom(&random, sizeof(random));
+	if (!ok)
+		return ok;
+
+	snprintf(pin, 8, "%07u", random);
+	pin[7] = compute_check_digit(pin);
+	pin[8] = '\0';
+
+	return true;
+}
diff --git a/src/wscutil.h b/src/wscutil.h
index 2764f0d9..23ba9f48 100644
--- a/src/wscutil.h
+++ b/src/wscutil.h
@@ -640,3 +640,4 @@ bool wsc_kdf(const void *kdk, void *output, size_t size);
 
 bool wsc_pin_is_valid(const char *pin);
 bool wsc_pin_is_checksum_valid(const char *pin);
+bool wsc_pin_generate(char *pin);