webpassgen VS scrypt

Individuals like OP, who are contemplating a switch to Bitwarden (and therefore probably do not have access to any Bitwarden clients yet) can use Bitwarden's Online Password Generator (after setting the Type option to "Passphrase"), or use other online passphrase generators (although you should probably do a little bit of due-diligence research on the generator tool that you choose before trusting it to generate the master password for your Bitwarden vault).

For your Bitwarden master password, you can use this password generator, which has 22 different English word lists (and many non-English options as well) for generating passphrases at a specified minimum entropy level. For example, select the option "Colors" in the "Alternate" box, and you will get a passphrase that looks something like this:

Yes, Bitwarden has an online passphrase generator (change the "Type" to "Passphrase"), but since you are responding to a comment by /u/atoponce, I would be remiss not to recommend Aaron's own passphrase generator tool (https://ae7.st/g/), as well as his project to audit online password/passphrase geenrators.

The only pw gen I trust (download it and run it locally): https://github.com/atoponce/webpassgen

Thanks! Note, the source code is at https://github.com/atoponce/webpassgen. I'd rather you opened it locally in your browser rather than trusting my web server. Also, it's probably high time for a new release.

I have also seen ones online like this .

I don't necessarily agree. I wrote a web-based password generator (and a command line version) that doesn't rely on any 3rd party libraries, like JQuery, Bootstrap, Vue.js, Angular, etc. with the primary focus being a clean UI and pleasant UX. I like to think I achieved those goals.

Check out the scrypt encryption tool.

Given that the encryption algorithm is open source (https://github.com/Tarsnap/scrypt) can you try to explain what you mean here?

I wouldn't use OpenSSL personally. If you just need simple but secure symmetric encryption, checkout the scrypt(1) encryption utility from Tarsnap. If you need support for public keys, check out age(1).

scrypt if you strictly only need symmetric encryption.

^ "scrypt page on the Tarsnap website". Retrieved 21 January 2014.

First of all I know that "implementing your own cryptography is bad". However, at some point, one does stumble upon a use-case that is not (well) covered by existing tools.

Now, assuming one has already done his due-diligence and has read (and hopefully understood at least the main ideas of) cryptography related articles / posts / etc. (especially in the area pertaining to what one wants to build), and thus we can assume one is not a complete newbie in this mater, however, nor is he an expert. Basically we can assume he is an "amateur".

Where would one go with his design to ask for feedback about it, in the hope to at least eliminate some weaknesses that one (as a non expert) might have overlooked. (I'm not speaking here about "proofs" or "audits".)

----

More specifically ---- but please let's not get into this right now, this being just an example ---- I'm trying to implement something similar to `scrypt` (the encryption utility, that uses the `scrypt` PBKDF, ) or `age` (), as a replacement to my current solution that relies on GnuPG.

It entirely does and that's exactly my point. Most "hashes" are designed to be fast, for data validation/checking whatever. For securing data (passwords, anonymisation, etc) you want a "hash" to be as slow as possible. Scrypt for example is designed to be extremely slow and use much memory (making GPU-based parallelisation useless and driving up the cost of CPU-based work). The default settings for five-second hashes changes their 18 hour estimate to a bit over two years... and that's assuming you don't turn it up further.