Chapter 5 · 5.1
Generating strong passwords and passphrases
Let your manager's generator come up with your passwords. Passwords people invent themselves almost always follow a pattern, and attackers try those patterns first. To learn what really makes a password strong, see the lesson What a strong password really is in the Safe online course.
What should you set?
| For | Advice |
|---|---|
| A website or mailbox that your manager fills in for you | A random password of at least 15 characters. Longer is fine, for example 20 or more. You never have to remember it. |
| Something you sometimes have to type yourself, such as your computer password | A passphrase of five or six random words with a separator. |
| Your master password | A passphrase of five or six words (see Your master password: create it, store it and never lose it). |
Length makes a password much stronger than unusual characters do. If a website doesn't accept a certain character, turn that character off and make the password longer.
In Bitwarden
- Open the browser extension and choose the Generator tab. In the web vault, you'll find the Password generator under Tools.
- Choose Password or Passphrase.
- For a password: set the Length to at least 15. For a passphrase: set Number of words to five or more and choose a Word separator.
- Copy the password, or choose Use this password if you're editing an item.
When you create a new account on a website, the extension can suggest a strong password right in the password field and save it after you sign up.
In KeePassXC
- Choose Tools, Password Generator. Or, in an item, click the dice icon next to the password field.
- On the password tab, set the length and the types of characters. On the Passphrase tab, choose the number of words and the word separator.
- Click Generate for a new suggestion and use it in your item.
With the KeePassXC-Browser extension, you can also generate a password on a website: right-click in the password field and choose the password generator in the KeePassXC menu.
At WebOké
Use passwords from your generator for My WebOké, DirectAdmin and your mailboxes too. To find out which passwords come with your package and where to change them, read Secure passwords and what to do about a leaked password and Your WebOké passwords in your manager.
Tip: Don't change everything at once. Start by replacing the passwords for your email, My WebOké and your bank. If your manager warns you that the password for another site is weak or reused, replace it the next time you log in there.