Password Generator

Introduction

Most bad passwords aren't intentionally bad, they're just made under pressure, the twentieth account sign up of the year, or because it would be easy to remember, and easy to remember is better than not remembering, so long as you're not remembering the password. The problem here is the word "fast" and "familiar" is exactly what makes a password easy to crack. A password generator addresses this by generating a truly random and unpredictable password, one that no attacker can guess, in one click, rather than a tired human brain.

It discusses how password generators really work, the difference between a strong and a weak password, when to use a random password and when to use a passphrase, and how to make it a habit to use a password generator for all your accounts and not just important ones.

So, what is a Password Generator?

A password generator is a program that generates random passwords automatically, depending on the parameters you choose (password length, what types of characters to use, etc.). The generator does not require the human brain to come up with something memorable and unpredictable, which is a very difficult task, but it uses randomisation instead to create a string of characters that bears no discernible pattern.

That's the point of randomness. Our passwords can be easily guessed: a name, a birthday, a common keyboard sequence, or a common word followed by an exclamation point. These practices are common targets of attacks and password cracking tools are designed to take advantage of these practices. A well-established password doesn't have any such propensity to exploit.

The workings of Password Generators.

A good password generator is based on cryptographic randomness, not the randomness of, say, a dice-rolling simulation, but one that's designed to be unpredictable even to a software developer. This is commonly known as password entropy – the number of possible combinations that an attacker would have to make to guess the correct one. The greater the entropy the longer a brute force attack would take even with a very powerful machine.

Good generators also don't send your generated password to a server, but process that on your machine, within your browser. This is more important than it sounds — if the password is never sent from the device, it cannot be stolen, copied or leaked in a data breach on the tool provider's side.

It is essential that you use a password generator to create a secure password.

• Determine the number of characters you want – 16 characters is a good standard to use for most accounts – more (20+) for something very sensitive such as a primary email or financial account.
• Select your character types – include upper case, lower case, numbers and symbols. All four results in the strongest.
• Also exclude ambiguous characters (optional) – some generators will also allow you to remove characters that are easy to mistake, such as 1, l, I, or 0, O — if you ever need to type it out, it will be helpful.
• Generate – this will create a random password that meets your requirements.
• Re-generate, if necessary – If a symbol is rejected, or the output is awkward to type, regenerate it, rather than edit it (editing eliminates randomness).
• Keep it securely – write down the password in a password manager, not on a note, spreadsheet or autofill in the browser.

Random Passwords vs Passphrases

The majority of generators are available in two distinct output styles, with both of which have a valid purpose.

Random passwords contain a high entropy per character and are dense with letters, numbers and symbols, such as K9$mPq2#vL7n. These are perfect for the accounts that you'll be logging on to via a password manager's autofill feature since you'll never have to type it again.

Passphrases are similar to correct-horse-battery-staple – a jumble of words, typically dashes between, that are unrelated. Each word has a higher entropy than a single letter, so a passphrase made out of four or five random words could be as secure as a shorter random password, but is much easier to type correctly by hand or read aloud. Passphrases are better suited to situations that require the entry of a password, such as unlocking a device or logging into a smart TV app, with the exception of passwords that are likely to be entered again.

There is no "best" or "worst" option since it depends on where and how you will be entering the password.

How to Make a Secure Password?

There are three elements to a good password:

• Length: The length is more important than any other factor. Each additional character is a factor of n factors where n is the number of characters added. Normally, you should have at least 12 characters, and 16 or more would be preferable for important accounts.
• Randomness: A strong password is one that is not obvious and has no discernible pattern – keyboard pattern (qwerty, 12345), personal information that may be known from simple research on the account holder (names, birthdays, pet names, etc.), dictionary words.
• Uniqueness: A strong password is not a strong password if it's used multiple times. When one service gets breached and your password is compromised, it's easy for attackers to try it on other accounts; this is called credential stuffing. Any breach to one account will have a unique password with the damage in that account.

Just How Big a Difference Does This Make? The difference between a weak password and a strong one is not just big; it's huge — orders of magnitude big. A short password, made of lower case characters, can be broken in seconds or minutes by contemporary hardware. If you add in the uppercase letters, numbers and symbols, and extend the length to 12+ characters, the same attack can take years to decades, just because the number of possible combinations becomes very large, with each character type and character added.

Is It Safe to Use an Online Password Generator?

Any security tool will make the same claim and the answer will be contingent on the particular security tool's construction.

• Seek local (client side) generation. Do not generate the password on a remote server and send to you, but use the random function that is built into your browser. This implies that your password will not be sent across the web and never has the opportunity to be logged or taken.
• Ensure there is no stored equipment. A reliable generator does not store, record, or send the passwords that it generates. If a tool says it will remember your passwords that you generate, but you don't create an account or vault first, then be wary.
• Use a trusted security vendor's tool. Password managers, as well as cyber security firms that develop password generators as a core component of their larger security offering, have the expertise and the motivation to do it correctly, as the trust is fundamental to their business.

When used properly, a browser-based password generator is as secure as a paper-generated password in your head — if not more so, since there's no human error of predictable patterns.

What to do with a Generated Password

Creating a strong password is only part of the solution—you must store and use it appropriately.

• Use a password keeper. This is the one most important change you should make to your password routine. A password manager keeps all of the password that is generated in an encrypted vault; it automatically completes them when required and helps you never have to remember (or reuse) a password again.
• Do not use elsewhere. Use a different and unique password for each account, including those that seem insignificant. Low-stakes accounts are frequently the first targets of attackers, as many will also be able to gain access to higher-value accounts with the same credentials.
• Don't store passwords as plain text. Common weak spots include notes apps, spreadsheet apps, sticky notes, and more — it's easy for anyone to access your notes the moment they log into your device or account.
• If possible, allow 2 factor authentication. Even if the password is leaked, it will be much harder to take a password and 2FA over a strong password than it would be to take a strong password alone.

Frequently Asked Questions

Final Thoughts

A password generator takes away the weakest security practice most users have – the inclination to pick a familiar phrase rather than something random. Use a long, unique password for each account, write it on a piece of paper or record it in a password manager (not on your own memory), and, if available, use two-factor authentication. It's a minor adjustment in behavior that goes to closing one of the most frequent entry points for attackers.