I have an Android mobile app which currently asks the user for a username and password to login. For security reasons, the session token expires in 2 hours so it has to ask for the username and password often which can be frustrating and annoying for mobile for users. I'd like to replace the username and password screen with a PIN code screen to make it easier for the user to login often. What are some best practices and standards for PIN code implementation without compromising the security of the application?
At first login, the app will ask the user to input a preferred PIN code after they have logged in successfully.