Generate strong random passwords

Entropy: how strength is measured

Strength here is entropy, measured in bits. For a random password it is simple math: the length times log2 of the number of possible characters. Each extra bit doubles the number of guesses needed to try every option.

With all four sets on and look-alikes left out, the pool is 81 characters, about 6.34 bits each. Octoolo labels the result Weak below 50 bits, Fair from 50, Strong from 75 and Excellent from 100.

Length does more than variety. Adding symbols to a 16-character password gains about 8 bits; making it four characters longer gains about 25. And the math only holds for passwords picked at random. One a person makes up, like Summer2024!, has a fraction of the entropy its length suggests, because attackers try such patterns first.

Random the right way

Two details separate a good generator from a weak one, and both are invisible in the output.

• The random source. Octoolo draws from crypto.getRandomValues, the cryptographic random generator of the web engine it runs on, the same kind used to make encryption keys. Ordinary random functions in many programming languages become predictable once an attacker has seen enough of their output.
• No bias. Turning a random number into one of 81 characters with a plain remainder makes a few characters slightly more likely than the rest. Octoolo throws away the random numbers that would cause that and draws again, so every character in the pool is exactly as likely as every other.

One thing it does not do is force each kind of character into every password. Each character is drawn from the whole pool, so a password can come out without a digit or a symbol, more often the shorter it is. If a site insists on one of each, generate a few and take one that fits.

Fitting the rules sites set

• A symbol is refused? The symbol set is ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? / ~, and some sites reject a few of these. Switch !@# off and add two or three characters of length to make up the entropy.
• A length cap? Some older systems cut passwords short, sometimes without saying so. If a new password does not work when you sign in, set a shorter length and try again.
• A PIN or a numeric code? Use only 0–9, and switch off No look-alikes, because it leaves the digits 0 and 1 out.
• Typing it on a TV or game console? Letters and digits with look-alikes left out, and a few extra characters of length, are easier to enter with a remote.

Whatever the rules, use each password for one account only. A strong password reused on two sites is only as safe as the weaker site.

After you generate it

A strong password only helps if it is unique to one account and kept somewhere safe. That is the job of a password manager, and Octoolo has one in its Passwords app: the Password manager keeps your logins in an encrypted vault on your PC, and its own generator also makes passphrases of 3 to 10 words, which are easier to type and remember. To find out whether an old password has turned up in a breach, use the password leak check.

A note on copying: if Windows clipboard history (Win V) is on, anything you copy, a password from this list included, stays in that history until you clear it. The Password manager's own copy button keeps secrets out of clipboard history and clears the clipboard after a short time.