Help
Blocked or forgotten DNIe PIN, and expired certificates
Guide updated: · by David Pelayo (nexoapex)
The DNIe (the Spanish electronic ID card) has no PUK. If the PIN gets blocked after 3 failed attempts, or the certificate has expired (which happens every two years, well before the physical card), the only fix is in person, at a DNIe Update Point (PAD), with your fingerprint, free and with no appointment. There is no way to fix it online or by phone.
Why does the DNIe PIN get blocked?
It's a security measure built into the chip itself, the same idea as a SIM card: after 3 consecutive wrong PIN entries, the DNIe locks itself to prevent brute-forcing. The difference from a SIM is that the DNIe has no PUK code you can use to reverse the block yourself from home. If a program warns you that "the smart card is blocked" ("la tarjeta inteligente está bloqueada" in Spanish), this same block is the most likely reason.
What should I do if I've forgotten my DNIe PIN?
The official route is to change it for a new one. The initial PIN is generated at random when the DNIe is issued and handed to you in a sealed envelope ("sobre ciego"). If you have forgotten it or lost the envelope, go to a DNIe Update Point (PAD) at an issuing office, with no appointment. There, choose "He olvidado mi contraseña" (I have forgotten my password), place the finger the screen asks for on the fingerprint reader, press "Cambiar contraseña" (Change password) and set the new PIN. That is how the official Police manual describes it. Don't use up attempts guessing: the third wrong entry in a row blocks the card, and the fix is the same.
How to unblock a DNIe PIN, step by step
- Go to a DNIe issuing office — any police station that offers this service, with your card on you.
- Find the DNIe Update Point (PAD) — a self-service kiosk inside the office itself; no appointment, no counter queue.
- Identify yourself with your fingerprint and set a new PIN — it's free and takes minutes.
DNIe for Mac detects the block as soon as you enter the PIN and shows you these same steps inside the app, with a link to find your office.
Can the DNIe PIN be changed or unblocked online?
No. The Police say so explicitly: "Por motivos de seguridad NO ES POSIBLE cambiar el PIN a través de Internet" — for security reasons, the PIN cannot be changed over the internet (dnielectronico.es). That goes both for changing a PIN you remember and for unblocking a blocked one: both are done in person, at a PAD. If you remember the PIN, typing it in is enough; if you have forgotten it or it is blocked, you identify yourself with your fingerprint. It can't be done by phone either. Be wary of any service, app or agency offering to unblock your DNIe online — that procedure does not exist.
What exactly is a PAD (DNIe Update Point)?
A DNIe Update Point is a self-service kiosk installed inside DNIe issuing offices (police stations). You use it to change or unblock the PIN and to renew expired certificates. To unblock the PIN or renew the certificates you identify yourself with your fingerprint, you need no appointment, and the service is free.
Where is the nearest PAD? Not every police station issues the DNIe: check the National Police's official list of DNIe issuing offices and pick the closest one. Bring the card — nothing else is needed.
Expired certificates: the card still works
DNIe certificates expire every two years — much sooner than the physical document, which stays valid for several more years. That is not an administrative habit: it is set by article 11.3 of Royal Decree 255/2025, which regulates Spain's national ID — "el plazo de validez de los certificados electrónicos contenidos en el Documento Nacional de Identidad será de dos años" (the electronic certificates on the national identity document are valid for two years). With expired certificates you can still read your data normally, but no e-government site will let you sign in or sign until you renew them.
How do you know when they expire, or whether they already have? If you gave an email address when your ID was issued, the Police email you there a month before the certificates expire (dnielectronico.es). When it reads the card, DNIe for Mac labels each certificate, for free, as "Vigente" (valid), "Caducado" (expired) or "Revocado" (revoked); to tell whether a certificate is still valid or has been revoked it queries the OCSP service, so it needs an internet connection.
How to renew DNIe certificates
Almost the same way as unblocking the PIN: at a PAD in any issuing office, with your PIN and your fingerprint, for free, no appointment. The kiosk generates fresh certificates on your existing card — you don't need a new card, and there is no online renewal. DNIe for Mac warns you about expiry as soon as it reads your card.
Revoked DNIe certificate: what it means and what to do
A revoked certificate has been invalidated before its expiry date: no e-government site accepts it for signing in or for signing, and revocation is permanent. It happens, among other cases, when the DNIe is reported lost or stolen, when the holder requests it, or when a new ID card is issued, because the previous card's certificates are invalidated. The DNIe's Certification Practice and Policy Statement sets this out.
If the card is still in your hands and valid, the fix is to generate new certificates on the same card, at a PAD, with your PIN and your fingerprint. The Police explicitly provide for renewing a signing certificate revoked at the holder's request (dnielectronico.es). If the PIN is blocked, unblock it first at the same PAD. If your DNIe has been replaced by a newer one, use the newer card. None of this can be done online.
What if the physical card has expired too, not just the certificate?
That's a different case. If the document itself is past its validity date — not just the certificate — the PAD won't help: you need to book an appointment at citapreviadnie.es to be issued a new DNIe.
How DNIe for Mac helps
When it reads your card, DNIe for Mac detects whether the certificates have expired or been revoked; if the PIN is blocked, it detects that as soon as you enter it. Either way it explains the problem in plain language instead of a cryptic error, with this same guidance built into the app. DNIe for Mac is an unofficial product by nexoapex: it can't perform the unblock or renewal itself — only the Police at a PAD can — but it saves you from guessing. More on how DNIe for Mac works or how to get it.
If the card is fine but your Mac won't read it, see which DNIe card reader works on a Mac; if AutoFirma is what fails, go through the ways AutoFirma fails on a Mac.
How can I find out what my DNIe PIN is?
The initial PIN comes in the sealed envelope ("sobre ciego") you are given when the DNIe is issued; if you changed it later, it is the one you chose. If you don't remember it, the official route is to change it: at a DNIe Update Point (PAD) in an issuing office, choose "He olvidado mi contraseña" (I have forgotten my password), identify yourself with your fingerprint and set a new PIN, with no appointment. It cannot be changed online.
Can I change the DNIe PIN from home?
No. Spain's National Police (Dirección General de la Policía) state that the PIN cannot be changed over the internet. It is changed at a PAD in an issuing office, with no appointment, whether or not you remember the current PIN.
Do I need an appointment to unblock the PIN or renew the certificate?
Not for the PIN or the certificates — the PAD is self-service. An appointment at citapreviadnie.es is only needed if the physical card itself has expired and you need a new DNIe.
How much does it cost to unblock the PIN or renew the certificate?
Nothing. Both procedures are free at the PAD.
How do I know whether my DNIe certificates have expired or been revoked?
DNIe for Mac shows this for free when it reads the card: it labels each certificate "Vigente" (valid), "Caducado" (expired) or "Revocado" (revoked), and it needs an internet connection to tell whether a certificate is still valid or has been revoked. Through official channels, the Police point you to VALIDe and to the FNMT's "Verificar estado" (check status) service, which tell you whether the certificate is active or revoked; we explain this in how to check that the DNIe works.
Can DNIe for Mac unblock the PIN for me?
No — no app can, because the DNIe has no PUK and requires in-person biometric verification at an official PAD. What DNIe for Mac does is detect the problem and tell you exactly what to do and where, instead of a generic error.