A few good questions.

what3words gives each 3-metre square on Earth a three-word address. You can use it to identify a precise spot, such as a corner of a garden. PlacePass uses the English address for your selected square as the starting point for your password.

Learn more about what3words ↗. PlacePass is an independent project and is not affiliated with what3words.

PlacePass connects a readable password with a place you remember. It combines the location’s three words with your PIN to choose a capital letter, a character substitution where possible, a symbol and two digits. The same inputs reproduce the same password in this generator version.

The location is your memory cue. It does not make a password impossible to guess.

1. Search for a place or move the map. Switch to Satellite if it helps you recognise your spot.
2. Zoom in and line up the crosshair with your exact spot, then press Use this location. You can also tap the map. If the first press zooms in, select again at the closer view.
3. Check that the three-word address appears, then enter your PlacePass PIN.
4. Press Generate my password, then Copy to clipboard.

If you already know the address, paste it directly into the three-word address box.

Use a separate PIN for PlacePass, not your bank, phone-unlock or voicemail PIN. This version accepts 4–8 digits. Avoid obvious sequences, repeated digits and significant dates. A less predictable 6–8 digit PIN gives more input possibilities, but the readable output format still limits the number of possible passwords for a given location.

Leading zeros matter: 0123 and 00123 are different inputs. You must remember the exact PIN; there is no PIN reset.

You can choose a square anywhere supported by what3words, without physically visiting it. Choose a precise spot that you can find again. An obscure place is less obvious than your home entrance or a famous landmark, but a privately remembered place can still be guessed.

“Use my location” only moves the map to your approximate position. Check and select the exact square yourself. GPS accuracy and satellite imagery vary.

Return to the generator, select the same exact square and enter the same PIN. Or enter the same three English words directly. Press Generate to recreate the password.

A neighbouring square has different words. Capitalisation and extra spaces in typed addresses are normalised, but spelling, word order and your PIN must match. If you manually changed the generated password, you must repeat those changes too.

Build 3 uses the original V1 password rules. Interface updates have not changed the passwords it produces.

You can recreate it without a written copy if you remember the exact square and PIN, and the matching generator remains available. That is not a guarantee against losing access. A password manager can keep a backup, and you should keep the account provider’s recovery methods up to date.

If you forget your location or PIN, PlacePass cannot recover them. Use the account provider’s password-reset process.

Anyone can view the HTML and JavaScript downloaded by their browser, including the generation rules. Reading the code does not reveal another visitor’s inputs, because those inputs are not part of the published files.

However, someone can copy the rules and test guesses offline. For known three words, the current format has a limited set of capitals, substitutions, symbols and digits. An attacker can enumerate those outputs without trying every PIN or running the slow derivation step for each one.

If a generated password is exposed, its recognisable words may also reveal the underlying location. This prototype has not had an independent security audit and is not recommended for protecting important accounts. For those, use a password manager’s random passwords or passkeys where available, together with two-step verification.

A mix of upper- and lowercase letters, numbers and symbols can satisfy a website’s formatting rules. It does not measure how hard a password is to guess. The number of possible outputs and how the inputs are chosen matter too.

The NCSC explains that familiar substitutions are known to attackers ↗. Its random-word guidance is not an endorsement of this location-based generator.

The same words and PIN produce the same password, regardless of which account you use it for. Do not reuse a password across accounts. Different inputs can also produce the same output; uniqueness is not guaranteed.

This prototype has no account-specific input or password-change counter. If you need to change a password, returning to the old inputs recreates the old one.

The original password generator calculates the password in your browser. Its code does not save the words, PIN or password to a database, cookies or browser storage, and does not send the PIN or password in map requests. Clearing the page removes its visible inputs; it does not clear your device’s clipboard.

Map providers receive requests for the areas you view; place searches are sent to the search provider; and your selected coordinates go through the PlacePass server to what3words. These providers and the website host can receive network information such as your IP address. PlacePass includes no analytics. Its server keeps temporary request counters using a daily hashed network address to limit abuse. The lookup code does not save selected coordinates or words; hosting logs may record other request information.

QR management is different: the management password is sent over HTTPS to authenticate changes. The server stores a salted hash and keyed fingerprint, not the readable password. QR Recovery V2’s phrase stays in your browser. This is not protection against a compromised device, browser extension or altered website code. HTTPS protects the connection; it does not prove the generator itself is secure.

No. PlacePass produces letters, digits, dots and a symbol, but sites have different length limits and character rules. Check the requirements of the account you are creating. Any edits you make afterwards must be repeated when recreating the password.

It explains how to save PlacePass in your browser. A website cannot reliably add a bookmark automatically. On a phone, use the browser’s menu or Share button; on a computer, use Ctrl+D on Windows/Linux or Command+D on Mac.

Bookmarking saves the page address only, not your location, PIN or generated password. If you are using an in-app browser, open the page in your normal browser first.

It opens your device’s share options where supported, or copies the generator’s website link. It does not include your location, PIN, generated password or page URL parameters. You choose whether and where to send the link.

Email chris@placepass.me with questions or feedback. Please do not send passwords or PINs. If reporting a problem, the error message and your browser name are usually enough.

PlacePass is free to use. If you find it useful, you can buy me a coffee to help cover the ongoing costs of the what3words API and server hosting. Thank you for helping keep it running.

Buy me a coffee via PayPal ↗

The PNG contains a permanent PlacePass link. When someone scans it, PlacePass redirects their browser to the current destination stored for that reference. You can change the destination without changing the image or reprinting it.

Open QR codes, make a dedicated management password, enter an HTTPS destination and review it. Confirm creation, save your password and permanent link, and download the PNG. Test the downloaded image with a phone before printing. The caption below the download reads “Dynamic QR code generated on PlacePass.me”.

Use the random-password button on the QR page or a strong password from your password manager. QR management accepts 24–128 characters. Do not reuse an email, bank or other account password. The original PlacePass location-and-short-PIN format has limited variations and is not recommended for controlling a QR link.

Yes, if you created it with QR Recovery V2. Enter exactly the same three English words and long recovery phrase in that mode. It returns the same management password. The recovery phrase must be 24–256 characters; prefer at least five randomly chosen words. Spaces, capitalisation and spelling in the phrase matter. A weak phrase remains guessable: this is not a security guarantee. A random management password cannot be recreated from a place and must be saved.

Each management password can be used for only one QR code. If it has already been used, including as a retired password, creation is refused. This avoids sharing management credentials between QR codes. Changing a password does not make the old one available for reuse.

Enter the QR reference or permanent PlacePass link and the current management password. You can obtain the reference from the link encoded in the QR; use your phone scanner’s link preview or a QR reader that displays the encoded URL before opening it. Unlock the QR, enter a new destination and review the current and proposed addresses. Confirm within three minutes. If somebody changed the QR meanwhile, unlock it again and review the latest version.

Yes. Unlock the QR using the current password, then use Change the management password. Save the replacement before confirming. The old password stops working, but the printed QR and its destination stay the same. If you change to a random password, the old recovery ingredients will not recreate the new password.

Recreate it only if you originally used QR Recovery V2 and still remember the exact inputs, or retrieve it from your password manager. We do not collect an owner email or offer an ownership-recovery process. If you cannot recover the current password, we cannot safely give you management access. Contact the site owner to report abuse, not to bypass authentication.

HTTPS URLs on recognised public domain endings from IANA’s list, including .com, .uk, .fr and .me, are supported. Domains must resolve to public internet addresses when saved. IP addresses, private/local destinations, embedded login credentials, unusual ports, PlacePass destinations and several common link shorteners are rejected. Internationalised domains must use their ASCII/Punycode spelling. Domain endings are not proof of trustworthiness: phishing sites can use ordinary domains, and an allowed site can later redirect elsewhere.

The database stores the QR reference, destination, a salted password hash, a separately keyed fingerprint to prevent password reuse, status and timestamps. It also stores change history and submitted abuse reports. Temporary request limits use hashed network addresses. QR management passwords are sent over HTTPS for verification but are not stored in readable form by this code. The code does not record scan analytics; normal hosting logs may still record IP addresses and requested QR links. Destination addresses and history may contain personal information, so avoid putting private tokens or sensitive data in them.

Anyone with the QR or permanent link can discover the destination by following it. A QR code is public, not a privacy control. Changing its destination requires the management credentials. Keep the password secret: anyone who obtains it and the public reference can change the destination. Rate limits and hashing reduce risks but do not eliminate guessing, device compromise or other attacks.

No. The permanent link never changes, so the same PNG works. You can download it again after unlocking. Redirect responses use HTTP 302 and no-store headers; scanner apps or other intermediaries may still have their own behaviour. Scan again to check the new destination.

The site owner can disable abusive or harmful QR links and review reports. A disabled link shows a notice rather than redirecting. Owners of disabled links cannot change them through the management form. Restoring a link requires the site owner; its original reference is retained and is never reassigned to a different user.

Use the report form on the QR page and include its PlacePass link or reference and a description. Do not include passwords or sensitive personal information. Reports are reviewed by the site owner; submitting one does not automatically disable a link. You can also email chris@placepass.me. This is not an emergency or guaranteed-response service.

Use the original PNG, keep the white border around it, maintain its square shape and avoid blur or decoration over the modules. Test a printed sample with different phones at the intended size and scanning distance. Consider printing your normal website address too, as a fallback if the redirect service is unavailable.

PlacePass’s dynamic QR service is currently free. Fees may be introduced in future, including for existing QR codes. Changes will be published on this website. Because owner email addresses are not collected, individual notification is not available.

The service and generated QR codes are provided as available, without a promise of uninterrupted access, permanent availability, error-free operation or suitability for a particular purpose. These statements do not exclude rights or liabilities that cannot lawfully be excluded. Test before printing and keep an alternative way to reach important information.

You are responsible for your destination and for keeping your management password secret. Anyone with the reference and password can change the destination. Do not use the service for phishing, malware, fraud, unlawful content or other abuse. We may disable harmful links or suspend the service to protect users. No ownership recovery or service-level guarantee is provided.

QR links depend on PlacePass’s domain, hosting and stored records continuing to operate. Backups reduce risk but do not guarantee recovery. Avoid using this free service as the sole route to essential, safety-critical or emergency information.