Password Generator

Local generation of random passwords

Modern encryption methods are technically so advanced that they have no known easy weaknesses and that brute-force attacks (a systematic approach that tries out all possible key combinations) would last much too long. But if the password is badly chosen, there is a chance with a dictionary attack, a special case of the brute-force attack. The weak spot for both attacks is the password chosen by the user.

Theoretically, a password should have a length of at least 20 characters in order not to be less secure than the encryption method itself (usually 112-bit or 128-bit keys for commonly used symmetric encryption methods). If the password were not composed of randomly chosen characters, then it would have to be even longer to provide the same amount of security.

The length of a password is often limited by the software (and in addition, for example for AES256, a password length higher than 32 without transformation would provide no additional security). So you should choose a combination of rarely used words, words from a foreign language, or made-up words. The components of the password should not be predictable by a person who knows about the interests and history of the attacked user.

An alternative would be to use a password generator and to memorize the generated password or store it at a secure location.

A reasonably secure password would be: 0aJ/4%(hGs$df"Y! (16 characters). However, such a password would be very hard to memorize and most people would probably write it down somewhere. An alternative that would be easier to memorize is a sentence known by the user, with some characters randomly changed, like "tHe bANANA*3 div 1/4 nICOTINE.“ Another good choice for a password is the combination of the first characters of a memorized sentence like “Irn10)mmJ!“ (built from the first characters of the sentence “I really need 10% more money Joe!” and an exchanged symbol).

Popular quotes from movies, books, or celebrities as well as combinations of simple words, calendar dates, names of pets, and family members etc. should be avoided. Such passwords can be easily cracked by dictionary attacks or attackers with background knowledge about the user.

A password generated here can be checked with the Password Meter in CTO and easily pass the password check (if the password is long enough). If you cannot memorize it, store it in a password manager like KeePass. The access to this has to be secured with a very good password!