What is a Master Password?

You should be using a password manager! A password manager such as LastPass, 1Password, or KeePass, let you track unique passwords for every website or service you use. But to access your password manager, you need to use a password! This is your master password. You need to be able to remember this password and it needs to be secure because if someone cracks it, they have access to all of your passwords.

Why are these passwords secure?

There are two important reasons these passwords are secure:

1. They are generated for you, so nobody can guess what words you might have chosen.
2. The choice of words is really large.

The reason lots of websites force you to use rules like needing one uppercase character and a number and some random symbols is because they want to ensure you add something to it that makes it harder to guess. If a password is a dictionary word, it's very easy for a malicious attacker crack it. Or if an attacker knows things about you they could guess your passwords if you could choose the words. For example, children's names and birth dates are very common if someone has to come up with a password that they want to remember.

But those rules do not guarantee your password is hard to crack. For example, if a website requires a number in the password, most people will take their normal password and add a 1 to the end. And if it needs a symbol, they'll add a ! to the end. Attackers know this and will try those combinations.

What makes a password secure is how many attempts an attacker would have to make to guess your password, even if they know everything about you.

This password generator works by choosing the password for you, so even if an attacker knows everything about you they could not guess what you would have chosen for a password. It also works by using a large dictionary of words, so even if an attacker knows you used this website to generator it they would still not be able to guess your password in a reasonable amount of time.

This generator matches very closely to the LastPass blog post about how to make a strong master password. Below there is a detailed example of how this password generator is secure.

Can You Give Me an Example?

Sure!

Let's consider two passwords: god1! and stylevesselsmarginbuffaloparker (this password is composed of the words style vessels margin buffalo parker).

The number of guesses it takes to guess god1! is 70⁵. That is 1680700000 guesses. For stylevesselsmarginbuffaloparker it is 9427⁵. That is 74450486000000000000 guesses. If an attacker can guess 1 billion passwords per second, it will take them 1.6 seconds to guess god1! and 2360 years to guess stylevesselsmarginbuffaloparker.

The password god1! is pretty short and maybe you would not pick such a password. You would need a password between 8 and 9 characters long to be equal to a four word password generated here. And between 10 and 11 characters long to equal a five word password, and 13 characters long to match a six word password. Those longer passwords are harder to remember than a few words.

What if an Attacker Doesn't Know I Used This Generator?

Then it's even better!

Going back to the password examples above, god1! and stylevesselsmarginbuffaloparker, if the attacker had to guess at random, the password stylevesselsmarginbuffaloparker is 31 characters long, which 1 with 57 zeros after it guesses which would take much longer than you are alive to guess. And that is much easier to remember than a 31 character password that has random letters and symbols in it.

How Did You Come Up With Those Numbers 70 and 9427?

Those are the number of options one can pick from at each point in the password. The number 70 is 26 * 2 + 10 + 8, or all the lowercase letters, all the uppercase letters, the numbers, and the symbols !@#$%^&*.

The number 9427 is the number of words that this dictionary has in it. So if you generate a five word password, each word can be one of 9427 words.

If you have any questions, comments, or bugs, contact contact@acsl.se