it's more secure on the back end. The DB will store a hashed unique pass phrase that isnt shared with anyone else.

You enter a pin, the web server sees a public key that only your side has the private key to.