Password Generator and Checker: Like Chrome, or Easy to Type on a Phone

Check a password

Type a password to see an estimate of how hard it is to guess. It stays in this page: nothing is sent, and nothing is saved. Better to check the kind of password that you use than the real one.

This is an estimate for a password chosen at random from the characters it uses, lowered for repeats, sequences, keyboard rows and the 10,000 most common passwords. A password made of words, names or dates is much weaker than the number says. The time is for an attacker who has a stolen hash and tries 10 billion passwords a second. A site that limits the attempts makes it far longer. It is not a full checker like zxcvbn.

Password Generator and Checker

This page makes a password in your browser with the secure random numbers of the browser (crypto.getRandomValues), so the password is never sent to a server and cannot be seen by anyone else. It has three kinds of password, because a good password for a password manager and a good password that you must type by hand on a phone are not the same thing.

Random password

Choose the length and the kinds of characters. The generator puts at least one character of each chosen kind and mixes them with an unbiased shuffle. The option "No look-alikes" removes 0, O, 1, l, I and |, which is useful when you must read the password from paper or a screen. Use 16 characters or more for an account that matters, and let a password manager remember it.

Password like Chrome

When you click a password field on a sign-up form, Chrome offers to suggest a strong password. The rule is public, it is in the source code of Chromium: 15 characters by default, made of lower case letters, upper case letters, digits and the symbols - _ . : !, with at least one lower case letter, one upper case letter and one digit. Chrome leaves out the characters that look alike (0, 1, l, I, O). This generator follows the same alphabet and the same rule, so you can make such a password anywhere, also when Chrome does not offer it. It is about 89 bits, which is a lot more than a site needs.

Password that is easy to type on a phone

A strong password is hard to type by hand on a phone: capital letters need Shift, digits and symbols need another page of the keyboard, and one mistake is invisible behind the dots. The suggestion of a password manager or of Chrome is fine when it is filled in for you, and a pain when you must type it on a TV, a console or a new phone.

The third kind makes the password of syllables, a consonant and a vowel each (kuvobi@tazemu@nipefo). There are 70 such syllables, so every syllable adds about 6.1 bits, the same as a random character from a set of 70. You type letters and almost no signs, you can read the password aloud, and you can remember it by its sound. Ten syllables with two digits, a capital letter and a symbol are about 69 bits, and 15 syllables are about 92 bits, as much as the 15 characters of Chrome. The price is the length: 30 letters instead of 15 characters, but with no Shift and no keyboard switching. The counter under the password shows how many characters need Shift or another page of the keyboard.

Sign-up rules of the sites

Most sign-up forms want the same: a minimum length, upper and lower case letters, a digit and a symbol. For example Proton Mail asks for 8 characters at least (it recommends 12), upper and lower case letters, digits and symbols, and one symbol is enough. The password for a phone is made to meet this: a capital first letter, digits at the end and a symbol between the words, with Latin letters only. The only symbols are @, # and $: they are the easiest to find on the keyboard of an Android phone and of a computer. If you switch the symbol off, there is none, and the box under the password turns red and tells you what is missing. The checker has a row with the same rules.

Check a password

Type a password in the checker. It shows the length, the kinds of characters, how many bits a random password of this kind would have, and how long it takes to try half of all such passwords at 10 billion guesses a second (an attack on a stolen database of hashes). The estimate is lowered for repeats, sequences like abcd and 1234, rows of the keyboard like qwerty, and for the 10,000 most common passwords, also with a few digits added (Password1). The list is loaded when you start to type.

It is an estimate, not a promise. A password made of words, names or dates is much weaker than the number says, and the checker cannot know your birthday. Do not check the password that you really use: check one of the same kind.

How to change a password in Linux

To change your own password, open the terminal and run passwd. It asks for the current password and then for the new one twice. To change the password of another user, run it as root:

sudo passwd username

Useful variants:

• sudo passwd -e username makes the password expire, so the user must choose a new one at the next login.
• sudo passwd -l username locks the account, and sudo passwd -u username unlocks it.
• echo "username:newpassword" | sudo chpasswd sets the password in a script. The password is then in the history of the shell and in the list of processes, so use it only for a temporary password that the user changes at once.
• On macOS the command passwd in the Terminal works the same way. In Windows, net user username * asks for the new password without showing it.

Make the new password here, and copy it into the prompt: the terminal shows nothing when you type, so a long password is easy to mistype.

"Please check your password and try again"

This message says that the login did not match, and it never says which part is wrong, on purpose. The usual reasons are:

• Caps Lock is on, or the keyboard layout is other than you think (Cyrillic letters instead of Latin ones). Switch on "Show the password" in a field, if it has the option.
• A space was copied with the password, at the start or at the end.
• The password was changed on another device, and the browser or the mail program still sends the old one. Update it in the saved passwords.
• For an email account: the program uses the password of the account, but the service wants an app password, because two-step verification is on.
• The account is locked after too many tries. Wait, or reset the password with the link "Forgot password".

Limitations

• The checker is an estimate and not a full checker like zxcvbn: it does not know words, names or dates.
• The rules of Proton Mail are those of its sign-up form at the time of writing, and a site can change them.
• The syllables are made of 14 consonants and 5 vowels, chosen to be easy to read and say. They can by chance form a word of some language.
• For a master password of a password manager, a long password of syllables or words that you can remember is better than a short one with symbols.
• To get a hash of a password use the hash generator.