XKCD-password-generator VS webpassgen

Either use a password manager or a tool like xkcdpass.

Kinda like this, but personally we using in production /usr/share/dict/american-english-insane that create even more secure phrases that can be less than 6 words.

I use https://github.com/redacted/XKCD-password-generator.

Relevant XKCDs (There's always one) 1 2. For passwords, we're switching to a passphrase in the future, ditching complexity requirements, and setting a 25-character minimum. This may break things if you have legacy applications. Password are really rated using a metric called entropy, which is calculated using [char set]^[length]. Increasing the length has a greater effect on entropy, and therefore the security of a password. XKCD style passwords can be generated using a site like this, or implemented in a local application by implementing this Github repo. Even knowing how passphrases are generated a 5-word passphrase generated from a list of ~16k words is equivalent to a 14-character password with upper, lower, numbers, and 6 symbols as a character set.

you could generate a password with xkcdpass

If this C level is going to be stubborn about good password policy suggest a 6 word passphrase to him. They are easier to remember and type with around the same security as a full random large char set password. There are free web-based apps that do this, but if you're paranoid implement something like this github project in a local win app.

My word list contains 7227 words apparently, so 12.82 bits per word

https://github.com/redacted/XKCD-password-generator

Not sure how many bits a "good" password should be nowadays.

This for example - and you can see a working example here.

Individuals like OP, who are contemplating a switch to Bitwarden (and therefore probably do not have access to any Bitwarden clients yet) can use Bitwarden's Online Password Generator (after setting the Type option to "Passphrase"), or use other online passphrase generators (although you should probably do a little bit of due-diligence research on the generator tool that you choose before trusting it to generate the master password for your Bitwarden vault).

For your Bitwarden master password, you can use this password generator, which has 22 different English word lists (and many non-English options as well) for generating passphrases at a specified minimum entropy level. For example, select the option "Colors" in the "Alternate" box, and you will get a passphrase that looks something like this:

Yes, Bitwarden has an online passphrase generator (change the "Type" to "Passphrase"), but since you are responding to a comment by /u/atoponce, I would be remiss not to recommend Aaron's own passphrase generator tool (https://ae7.st/g/), as well as his project to audit online password/passphrase geenrators.

The only pw gen I trust (download it and run it locally): https://github.com/atoponce/webpassgen

Thanks! Note, the source code is at https://github.com/atoponce/webpassgen. I'd rather you opened it locally in your browser rather than trusting my web server. Also, it's probably high time for a new release.

I have also seen ones online like this .

I don't necessarily agree. I wrote a web-based password generator (and a command line version) that doesn't rely on any 3rd party libraries, like JQuery, Bootstrap, Vue.js, Angular, etc. with the primary focus being a clean UI and pleasant UX. I like to think I achieved those goals.