pwpush VS XKCD-password-generator

Alternatively self-host pglombardo/PasswordPusher and use abkierstein/pwpush to generate & link to send to users

Either use a password manager or a tool like xkcdpass.

Kinda like this, but personally we using in production /usr/share/dict/american-english-insane that create even more secure phrases that can be less than 6 words.

I use https://github.com/redacted/XKCD-password-generator.

Relevant XKCDs (There's always one) 1 2. For passwords, we're switching to a passphrase in the future, ditching complexity requirements, and setting a 25-character minimum. This may break things if you have legacy applications. Password are really rated using a metric called entropy, which is calculated using [char set]^[length]. Increasing the length has a greater effect on entropy, and therefore the security of a password. XKCD style passwords can be generated using a site like this, or implemented in a local application by implementing this Github repo. Even knowing how passphrases are generated a 5-word passphrase generated from a list of ~16k words is equivalent to a 14-character password with upper, lower, numbers, and 6 symbols as a character set.

you could generate a password with xkcdpass

If this C level is going to be stubborn about good password policy suggest a 6 word passphrase to him. They are easier to remember and type with around the same security as a full random large char set password. There are free web-based apps that do this, but if you're paranoid implement something like this github project in a local win app.

My word list contains 7227 words apparently, so 12.82 bits per word

https://github.com/redacted/XKCD-password-generator

Not sure how many bits a "good" password should be nowadays.

This for example - and you can see a working example here.