Choose a password, passphrase, or PIN

Start with what the secret unlocks

A password sent to a website may be exposed if that site is phished or breached. A device PIN usually unlocks one physical device and can be protected by attempt limits and secure hardware. They look similar in a text box but have different threat models.

The best default for an online account is a long, random, unique password stored and filled by a password manager. You do not need to memorize it, so memorability should not reduce randomness.

A practical decision tree

• Password manager can fill it: choose a 20-character or longer random password, subject to the site’s limits.
• You must regularly type it: use a genuinely random passphrase from a sufficiently large word list, or use a manager’s passphrase generator.
• It unlocks a phone or laptop locally: use the longest random PIN or device passcode you can enter reliably, and enable biometric convenience without forgetting the fallback code.
• The site offers a passkey: consider it. Passkeys are bound to the real site and resist ordinary password phishing.
• A site imposes odd rules: meet only the required classes, maximize length within the limit, and record the result rather than inventing a pattern.

Know this generator’s boundaries

RhinoPassword’s password tool uses the browser cryptographic random-number API and rejection sampling to choose characters. Characters are selected independently from the combined enabled pool; enabling uppercase, numbers, or symbols does not guarantee that every generated result contains one of each. Regenerate if a site requires a class that is missing.

The passphrase tool chooses from the 80-word list displayed in this application’s source. Repeated words are possible. Five words from only 80 choices provide about 32 bits from the word choices—far below a large diceware-style list—so do not use this tool’s passphrases for a password-manager master password, disk-encryption secret, or other high-value secret. Use a manager’s well-vetted large-list generator for those jobs.

The PIN tool draws digits uniformly. “Do not repeat digits” reduces the number of possible results; it is for systems that forbid repeats, not a strength upgrade. Online-account passwords should not be replaced by PINs unless the service designed the PIN as a device-bound credential.